Extracted

• • Target

    2f54f197e70f40de96a2be48757f9e136aea5d9bd388161f805cef57a51bd58d

  • Size

    4.5MB

  • MD5

    d3f837209d88f951d58f89320e087a95

  • SHA1

    dd375fe18bbfc217728bca757be978f4e23e3112

  • SHA256

    2f54f197e70f40de96a2be48757f9e136aea5d9bd388161f805cef57a51bd58d

  • SHA512

    24717e0b6435b2d8befead99df2483d75d1f1adae2c7915364d4e5a3f2bbc3bb9d1df9d18fe0233ab58cdbd60d2c88767800ddfa72356ac6cc08b2319a80a13e

  • SSDEEP

    98304:InX3/YiWTVeEBbeCMYcwqHie4munwOzL6iD:wH/YiWTVTbKilpwOzL6U

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2