Extracted

• • Target

    2f74d868692ce50e073cfdd6a2fbafa3.exe

  • Size

    2.4MB

  • MD5

    2f74d868692ce50e073cfdd6a2fbafa3

  • SHA1

    7e31e58f97728181a239583884cd6789e5ddf891

  • SHA256

    c237d3d7c79c5fb7795b875bd6f6c79e5bc95a96d41cf4249d755427dc4c1d58

  • SHA512

    811648978e206e396c790dca0bf61fd161711ed682842a6f95e4e2619e55a445078e56ff3c749ed1bd1e745c952276381029596e5b3d23a3415440b622279beb

  • SSDEEP

    49152:C9Poy707ePYSmuZMJdIdF/+zVQn/IZjjNf2UwcMyPOJPca0o83hlurCT:MAKbGcdFmVQn/IZjjfwcMyPGPcflH

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2