General
-
Target
1decbe120e5beaff817bc6dd186e2013.exe
-
Size
4.6MB
-
Sample
240111-hjl97sbbeq
-
MD5
1decbe120e5beaff817bc6dd186e2013
-
SHA1
4cbcb2ad2f50862b0910a036dd2fd12aa4a23f50
-
SHA256
6269c0afcf708d6b8bb3d7fa200009f6a177d60b6c5f9b174278dab56f716af1
-
SHA512
53f3ed6987f25a7e3aab470adb10df0a9408a4e5541c53a979761414a3fc2ec35cd3432927d30b60b9616c5e0472a5078222a163a96b5a620d247f4a8f5a830f
-
SSDEEP
98304:Ni/pvA3Q7kcOH1+TnUcumzJip7MDUzVm+3VvNppfc0ufQF3EMUc3Qq518SKH68S8:U/pv0ek5+7UVHoDUN3V5fc0wm0ZcgqwH
Malware Config
Targets
-
-
Target
1decbe120e5beaff817bc6dd186e2013.exe
-
Size
4.6MB
-
MD5
1decbe120e5beaff817bc6dd186e2013
-
SHA1
4cbcb2ad2f50862b0910a036dd2fd12aa4a23f50
-
SHA256
6269c0afcf708d6b8bb3d7fa200009f6a177d60b6c5f9b174278dab56f716af1
-
SHA512
53f3ed6987f25a7e3aab470adb10df0a9408a4e5541c53a979761414a3fc2ec35cd3432927d30b60b9616c5e0472a5078222a163a96b5a620d247f4a8f5a830f
-
SSDEEP
98304:Ni/pvA3Q7kcOH1+TnUcumzJip7MDUzVm+3VvNppfc0ufQF3EMUc3Qq518SKH68S8:U/pv0ek5+7UVHoDUN3V5fc0wm0ZcgqwH
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-