Live Stream VOD: Breaking Themida Protected C2 Config for Socks5Systemz (Patreon)

In this stream we attack a Themida protected C2 config using tracing in x64dbg and some other tricks. The malware analyzed is an older socks proxy botnet called Socks5Ssystemz which has been operating under the radar for years.

Note: This stream was was split over two days due to a surprise migraine! The themida RE starts at around the 40min mark.

Samples

• Older non-virtualized sample fee88318e738b160cae22f6c0f16c634fd16dbf11b9fb93df5d380b6427ac18f [UnpacMe]

• New Themida virtualized sample c9278f17730a4078d3b28e349d31dbdab961d8b61aab7b710f088d0f03a033c8 [UnpacMe]

Prior Work

Unveiling Socks5Systemz: The Rise of a New Proxy Service via PrivateLoader and Amadey