On the 1st of December, the notorious Socks5Systemz payload server hosted at AS57678 (Cat Technologies 🇭🇰) that is already active for several months started to serve a new version of Socks5Systemz ⤵️
🌐 https://t.co/qqJQHUldo4
This is the first major change since 2023 in Socks5Systemz and includes:
🔑 New RC4 key used during C2 communication: hi_few5i6ab&7#d3
👋 Direct IP communication through HTTP(s) for botnet command and control instead of the usage of a DGA and a custom DNS server
🔙 Backconnect TCP port changed from 2023 to 2024
Current botnet C2 servers:
188.119.66.185:443 CHANGWAY 🇭🇰
45.155.249.212:443 RACKPLACE 🇩🇪
91.211.249.30:443 PODAON 🇱🇻
Malware sample:📄 https://t.co/mmYfg6tkPG
Socks5Systemz IOCs: 🦊 https://t.co/UAuzQoqsEB
🚨 Attackers use public open directories for hosting #malicious scripts disguised as .txt and .jpg files
These are utilized in multi-stage #AsyncRAT#infections
See technical breakdown of the tactics from @RacWatchin8872 👇
https://t.co/ti7ipTjTiN