Malware

Socksbot

Socksbot is a Windows malware implant with remote-access and proxying functionality. Observed capabilities include launching SOCKS proxy threads to relay traffic through a compromised host, taking screenshots for operator surveillance, enumerating running processes for host discovery, and writing and executing PowerShell scripts for follow-on tasking. It also uses process injection by creating a suspended svchost process and injecting a DLL into it, indicating an emphasis on stealth and in-memory execution. The combination of proxying, host reconnaissance, screen capture, script execution, and injection behavior is consistent with post-compromise backdoor activity used to maintain access, support operator-controlled actions, and facilitate covert communications or pivoting through victim systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence6

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

T1055.001Dynamic-link Library InjectionEvidence1

Stealth

2 techniques

T1055Process InjectionEvidence1

T1055.001Dynamic-link Library InjectionEvidence1

Discovery

1 technique

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

Collection

1 technique

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

3 techniques

T1090ProxyEvidence2

"Aria-body has the ability to use a reverse SOCKS proxy module." / "BADHATCH can use SOCKS4 and SOCKS5 proxies..." / "Neo-reGeorg... establish a SOCKS5 proxy" / "Remcos uses the infected hosts as SOCKS5 proxies"

T1090.001Internal ProxyEvidence2

"APT41 used a tool called CLASSFON to covertly proxy network communications." / "BADCALL functions as a proxy server between the victim and C2 server." / "Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic..."

T1090.004Domain FrontingEvidence1

Aria-body has the ability to use a reverse SOCKS proxy module... BADHATCH can use SOCKS4 and SOCKS5 proxies... GoBear implements SOCKS5 proxy functionality... Neo-reGeorg has the ability to establish a SOCKS5 proxy... Remcos uses the infected hosts as SOCKS5 proxies...

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Malware capable of writing and executing PowerShell scripts.

mitre attack websiteNews

Oct 21, 2021

Process Injection: Dynamic-link Library Injection, Sub-technique T1055.001 - Enterprise | MITRE ATT&CK®

Malware that creates a suspended svchost process and injects its DLL into it.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware with screenshot capture capability.

mitre attack websiteNews

Oct 21, 2021

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Botnet malware capable of listing all running processes.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Socksbot