Extracted

• • Target

    5651a558156084441c907c02b38d45ca931ef7851aa38ce3da02fcdd84e331b1

  • Size

    6.9MB

  • MD5

    61413f6fdc62d25bff2dbde822bd93b8

  • SHA1

    6cd77763be5a14e75ab16a41d083b770cfb2bacf

  • SHA256

    5651a558156084441c907c02b38d45ca931ef7851aa38ce3da02fcdd84e331b1

  • SHA512

    8192c31abeb12b51b5656813c02e91a7503b2525bd5bc3b0f9fb7acb62a8328835a40a0e79b201275e1c3368bbda979036f734a14a3afab56df48bffad50c8dc

  • SSDEEP

    196608:AnwNQvqJX1cTQFYbVPNQv4jkSgGKVvlZSTx1Af:AnwyKFcTaSPNQgjoG4Sx1g

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2