Extracted

• • Target

    5b420a717a26e87669adc7ddcb94a545.exe

  • Size

    2.4MB

  • MD5

    5b420a717a26e87669adc7ddcb94a545

  • SHA1

    d68fe3d6384afca42ce84592e96f92703f6c5a56

  • SHA256

    8bd83991686cc480de09a4a436bb15dbd5ec7ec129b10dfa6f60e6d425e2772a

  • SHA512

    c349ea2f052d5696ec6679beae3dc9cb2fd2363d2ecf660adb035819f364b39ef3255fda96063d803249d5efea340ef63e74abed656fce7478a3756d1ae7fb71

  • SSDEEP

    49152:C98S78YwFBpSt7zxLdrvx5G9iVH39Uwk26BIqov0Fr3LJmtAopGP3CT:M85Idrvx5G9iVX9UFWqIyBm/EU

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2