Socks5Systemz
Socks5Systemz is a proxy bot malware that turns infected devices into traffic-forwarding proxies for malicious traffic. It has been sold on underground forums since 2013 and was widely commercialized through the PROXY[.]AM service, which later rebranded as ProxyBox after infrastructure disruption and sinkholing in early 2024. The malware has historically been distributed as a SOCKS5 proxy module embedded in other malware families including Andromeda, SmokeLoader, and Trickbot, and more recently as a standalone payload delivered by loaders such as PrivateLoader and Amadey. Observed infection chains also used cracked software lures and NSIS-based installers from pay-per-install and pirated software ecosystems.
The malware’s purpose is to provide residential proxy access for criminal use cases including carding, credential stuffing, identity theft, and other abuse. In one documented multi-stage infection chain, Socks5Systemz was deployed alongside PrivateLoader, Smoke, Lumma, RedLine, RisePro, Amadey, StealC, a miner, and STOP/DJVU ransomware. In that case it executed as DTPanelQT.exe and TacDecoLIB.exe, contacted 185.196.8[.]22 over port 80, and connected to 176.9.47[.]240 over port 2023, sending repeated IP-and-port lists consistent with proxy bot behavior.
Technical reporting describes a multi-stage loader chain culminating in a Socks5Systemz DLL of roughly 600 KB that uses junk code and control-flow obfuscation. The malware can be installed as a Windows service or regular executable; when invoked with an install flag it attempts persistence via service creation and falls back to a registry Run key if service creation fails. It cycles through command-and-control servers, trying each address multiple times and alternating between HTTPS and HTTP until successful. C2 communication uses URLs of the form http(s)://ip/ai/?key=<encrypted parameters>, with both requests and responses RC4-encrypted using a 16-byte key that may vary by sample. It uses the user-agent string "Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" and supports commands including Connect, Disconnect, Idle, Updips, and Updurls. Earlier reporting also states that Socks5Systemz connects to its C2 using a DGA.
The botnet has operated at significant scale. Reporting cited approximately 250,000 infected devices globally per day for the first iteration by late January 2024, while the rebranded ProxyBox service was observed maintaining roughly 32,000 to 35,000 daily active IPs. Significant concentrations of active IPs were observed in Russia, Brazil, and India.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
In an attempt to regain their once previous numbers the ProxyBox operators are observed utilizing pay per install (PPI) sites which distribute the malware through cracked software sites... These sites utilize NSIS installers which will dynamically install a series of applications.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
7 techniques
Stealth
The final payload of Socks5Systemz... heavily relies on junk code and control-flow obfuscation, making static analysis challenging.
Chunks of the encrypted payload are embedded within the .text section... Once the loader stub decrypts the second stage module... To decrypt the resource, it extracts a 32-byte key from the end of the resource... Both requests and responses are RC4 encrypted using the same RC4 encryption key.
The first operation the loader will perform in the main function is to register a service control handle... The advantage of this design decision is that it allows the module to function both as a service and as a regular PE/EXE.
Before unpacking, the loader will sleep in a loop to delay execution, both before and in the middle of the memory loading process.
It also uses timestamp stomping, showing that it was compiled in 2011, which is false.
Discovery
2 techniques
Discovery
Command and Control
7 techniques
Command and Control
Process 4440 is also seen communicating with its C2 server, 185[.]216.70.235 and 195.20.16[.]45 via port 80 (T1071 – Application Layer Protocol).
For the first iteration of the list it attempts to use HTTPS before falling back to HTTP... The C2 url is in the format http(s)://ip/ai/?key=<encrypted parameters>.
the panel can then task it... open a VNC or reverse-proxy session... We've also documented Amadey pushing proxy malware like Socks5Systemz
"Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices"
"Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices"
IOCs tracked for this family
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Proxy malware cited as a follow-on payload delivered by Amadey.
A malware family used to build and operate a large residential proxy botnet. It is distributed via cracked software and loaders, installs persistence via service or registry run key, unpacks a DLL payload in memory, and communicates with C2 servers over HTTP/HTTPS using RC4-encrypted parameters to receive commands such as connect, disconnect, idle, updips, and updurls.
Botnet used to provide an illegal proxy service by leveraging large numbers of compromised devices.
A proxy bot malware that converts infected systems into SOCKS/proxy nodes for forwarding malicious traffic. The content states it is commonly delivered through PrivateLoader and Amadey.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.