Extracted

• • Target

    90826bcb3fea845e7ddae834728dede639721d9b21b7581eef0ca1ee9f4775ff

  • Size

    7.4MB

  • MD5

    38e2dd22d157146919a056b06c6af89e

  • SHA1

    be35686f713ce5cff4f27fa39b326cfe29904efd

  • SHA256

    90826bcb3fea845e7ddae834728dede639721d9b21b7581eef0ca1ee9f4775ff

  • SHA512

    35166b4305d96e8e1b66d50c5439d8c296624c6fc1411989623d6940a1b776abd2851f653b306a1c20b8a37125713929d9ef13b1dd0d24f0dc62e65bcce5318f

  • SSDEEP

    196608:ZIy3g1YUIFr2j3TfKy94xILcF/j2oQPyghUTX61b:ZX3dUOMjCyeOLeCdVG65

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2