Socksbot - S0273 (e494ad79-37ee-4cd0-866b-299c521d8b94)

Socksbot is a backdoor that abuses Socket Secure (SOCKS) proxies. (Citation: TrendMicro Patchwork Dec 2017)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Socksbot - S0273 (e494ad79-37ee-4cd0-866b-299c521d8b94)	Malware	Proxy - T1090 (731f4f55-b6d0-41d1-a7a9-072a66389aea)	Attack Pattern	1
Socksbot - S0273 (e494ad79-37ee-4cd0-866b-299c521d8b94)	Malware	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Socksbot - S0273 (e494ad79-37ee-4cd0-866b-299c521d8b94)	Malware	1
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	Socksbot - S0273 (e494ad79-37ee-4cd0-866b-299c521d8b94)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	Socksbot - S0273 (e494ad79-37ee-4cd0-866b-299c521d8b94)	Malware	1
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	2
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2