Extracted

• • Target

    5102fde429682147fb8635e96bf8263f.exe

  • Size

    2.6MB

  • MD5

    5102fde429682147fb8635e96bf8263f

  • SHA1

    1040c5c04802f69370e0409b8ac8f7d6a3808580

  • SHA256

    f644a3e3901caee436ed74bedb70873ce5e286144569b93dcef7d6a61bb3d865

  • SHA512

    4300f11c8df22145775290bfa014dd99b5554a05896433c528f624d329e5419d7999ab69c8a5f776b8ed12ea0a0f5d960b818ab0072e8ea56252ce82f2cf7f6c

  • SSDEEP

    49152:C99/lzazwnNUHFYDChPohKFl+IUs9SXb+z6Q7N3/uAqfZM2GGCT:MxlzafHFYDChPoMFQwcXb+z68NPuAqxQ

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2