Top Tweets for #Socks5System

almost 3 years ago

The #Socks5System Proxy Bot Traffic Analysis Utilizes two types of C2 connections for communication, the proxy bot distributes roles between two servers: - HTTP/80 C2 connection - TCP/1074 Сlient connection streams and proxy server commands Link to the sample ↘️ https://t.co/k0BxwFQlMy The C2 connection diagram can be found in our last post ↘️ https://t.co/pw2Jk3mPFx The Socks5System proxy bot binds TCP/1074 sockets to communicate with the proxy server. The first packet one byte long determines the type of command being sent: 0x00, 0x01 or 0x02. An alive command connection on TCP/1074 conveys messages from the server describing client streams, structured as follows: 🟥 Address type (IP/domain) 🟩 Destination address (IP/domain) 🟧 Destination Port 🟪 Connection ID Upon receiving server commands, the proxy bot performs the following actions: 1⃣ Sends a 0x01 command packet type to the TCP/1074 2⃣ Sends a 10-byte packet with the client connection ID inside 3⃣ Relays data from the proxy-server clients to the internet This scheme of interaction with two servers allows the proxy bot to remain online with C2 to update proxy addresses and with the proxy to receive new client streams. Also stay tuned and check out the new samples at the tag link ↘️ https://t.co/cBxL1RKkIE

ANY.RUN

@anyrun_app

almost 3 years ago

#socks5systemz is a #malware that turns victims’ devices into proxies for forwarding traffic It was first spotted by our sandbox 3 years ago 👉https://t.co/tzTinSxxbP 🔹It attempts to connect via HTTP request to port 80 and a backconnect server over port 1074/TCP. ▪️By combining these two connections for the connect and updips commands, we illustrate how socks5systemz can be used to proxy traffic. Follow the tag link 👉 https://t.co/n0pq4BZ6fI 🔸You can also find socks5systemz in the public database using the signature 2829008. ▫️Here is a #CyberChef recipe for decrypting command connections 👉https://t.co/OqdZYPQ7R7

anyrun_app's tweet photo. #socks5systemz is a #malware that turns victims’ devices into proxies for forwarding traffic

It was first spotted by our sandbox 3 years ago 👉https://t.co/tzTinSxxbP

🔹It attempts to connect via HTTP request to port 80 and a backconnect server over port 1074/TCP.

▪️By combining these two connections for the connect and updips commands, we illustrate how socks5systemz can be used to proxy traffic.

Follow the tag link 👉 https://t.co/n0pq4BZ6fI

🔸You can also find socks5systemz in the public database using the signature 2829008.

▫️Here is a #CyberChef recipe for decrypting command connections 👉https://t.co/OqdZYPQ7R7

12K

Top Tweets for #Socks5System

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users