Loading malware…
Socks5Systemz is a Windows proxy-bot malware family that converts infected systems into traffic-forwarding proxies for criminal use. It has been associated with commercial proxy services historically operated under the PROXY.AM brand and later rebranded as ProxyBox, and has been observed for many years in both embedded and standalone deployment models. More recent activity shows the malware being distributed as a final payload by commodity loaders including PrivateLoader and Amadey, and also appearing in multi-stage cracked-software infection chains alongside infostealers, cryptominers, and ransomware.
On infected hosts, Socks5Systemz establishes persistence, commonly through a Windows service and in some cases fallback mechanisms that replace or abuse updater components. The loader decrypts and injects a DLL-based payload into memory, after which the malware identifies an active command-and-control server using a domain generation algorithm and actor-controlled DNS infrastructure, with encrypted HTTP communications used for C2 discovery and beaconing. Reported command support includes functions to idle, connect, disconnect, and update proxy-related infrastructure lists. When instructed, the bot connects to backconnect infrastructure and exposes the victim host as a rentable proxy endpoint, with access controlled either by client IP allowlisting or by username and password.
Operational reporting has linked Socks5Systemz to a large proxy-bot ecosystem with globally distributed victims and infrastructure supporting command-and-control, backconnect, DNS, telemetry, and proxy-checking roles. The malware has been used to monetize compromised residential and enterprise endpoints by selling proxy access to third parties, enabling abuse such as credential attacks, fraud, and other malicious traffic relay. In campaign observations, Socks5Systemz has also appeared as one component of broader criminal monetization chains in which the same victim is simultaneously subjected to credential theft, resource hijacking, and later-stage ransomware deployment.
The malware targets Windows systems and is notable for its role as a commercialized proxy service enabler rather than a traditional data-stealing payload. Public reporting has assessed links between the botnet infrastructure and Russian-speaking cybercrime operators, though attribution remains at moderate confidence.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
In an attempt to regain their once previous numbers the ProxyBox operators are observed utilizing pay per install (PPI) sites which distribute the malware through cracked software sites... These sites utilize NSIS installers which will dynamically install a series of applications.
Using a bot named BoostyProxy, the threat actor built a complete proxy service that allows users to subscribe to the service, manage the existing subscriptions, and access the current list of available proxies.
The install option is responsible for setting up the persistence on the system and to do so it will try to copy the loader to C:\ProgramData\ContentDWSvc\ContentDWSvc.exe and create a Windows service to run the copied loader with both the name and display name set to ContentDWSvc.
The loader main function will load the resource with ID 400 to memory and decrypt it. The decrypted data will be a valid DLL file containing the proxy bot that will be injected in memory.
The install option is responsible for setting up the persistence on the system and to do so it will try to copy the loader to C:\ProgramData\ContentDWSvc\ContentDWSvc.exe and create a Windows service to run the copied loader with both the name and display name set to ContentDWSvc.
The final payload of Socks5Systemz... heavily relies on junk code and control-flow obfuscation, making static analysis challenging.
I had been surprised to see the malware was signed. (I was new, this form of trust abuse was unknown to me.)
The loader main function will load the resource with ID 400 to memory and decrypt it. The decrypted data will be a valid DLL file containing the proxy bot that will be injected in memory.
Chunks of the encrypted payload are embedded within the .text section... Once the loader stub decrypts the second stage module... To decrypt the resource, it extracts a 32-byte key from the end of the resource... Both requests and responses are RC4 encrypted using the same RC4 encryption key.
The first operation the loader will perform in the main function is to register a service control handle... The advantage of this design decision is that it allows the module to function both as a service and as a regular PE/EXE.
Before unpacking, the loader will sleep in a loop to delay execution, both before and in the middle of the memory loading process.
It also uses timestamp stomping, showing that it was compiled in 2011, which is false.
If file copy or service creation fails, the loader will try to kill all Google update processes and replace the GoogleUpdate.exe original executable by itself.
If file copy or service creation fails, the loader will try to kill all Google update processes and replace the GoogleUpdate.exe original executable by itself.
The plain text beacon string has the following format: client_id=%.8x&connected=%d&server_port=%d&debug=%d&os=%d.%d.%04d&dgt=%d&dti=%d
Next, the bot generates a 32-bit client ID based on the creation date of the Windows directory on the infected system.
The data that goes in the c= parameter is the hex encoded result of encrypting the beacon string using the same RC4 key heyfg645fdhwi. The responses from the command and control servers are also hex encoded and encrypted using the same RC4 key.
Process 4440 is also seen communicating with its C2 server, 185[.]216.70.235 and 195.20.16[.]45 via port 80 (T1071 – Application Layer Protocol).
After getting the IP address of an active command and control server, the bot is ready to start the C2 communications by doing a HTTP GET request to the following endpoint /single.php?c=<rc4 data hex encoded>.
This sample, upon reverse engineering, was found to install a proxy bot on infected systems, turning them into proxies capable of forwarding traffic for someone else.
"Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices"
"Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices"
Additionally, it fetches a PDF file from hxxp://datasheet[.]fun/manual/avon_4_2022.pdf?<client_id> , saving it in the C:\ProgramData folder.
Finally, the bot tries to get the address of a C2 server that's online. To do so, the bot computes a domain name using a domain generation algorithm and uses a hardcoded list of DNS servers to resolve it.
172 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Proxy malware cited as a follow-on payload delivered by Amadey.
A malware family used to build and operate a large residential proxy botnet. It is distributed via cracked software and loaders, installs persistence via service or registry run key, unpacks a DLL payload in memory, and communicates with C2 servers over HTTP/HTTPS using RC4-encrypted parameters to receive commands such as connect, disconnect, idle, updips, and updurls.
Botnet used to provide an illegal proxy service by leveraging large numbers of compromised devices.
The sample discussed in the post is identified by community notes and sandbox reports as Socks5Systemz malware. The content indicates it is malware associated with abuse of a code-signing certificate, but does not provide deeper technical behavior beyond that identification.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.