Extracted

• • Target

    64eff7516ca3d56873cea7c8f907a595b6812f70353fa15cc253fe0c03e2248b.exe

  • Size

    2.6MB

  • MD5

    a79f8dad001028d741448b31d9bc1bde

  • SHA1

    9d86cb5d4b1724b196484dc38006996fa55f7a45

  • SHA256

    64eff7516ca3d56873cea7c8f907a595b6812f70353fa15cc253fe0c03e2248b

  • SHA512

    e7c0c9d070f2973bc2295a13a8cfc1bbd77f2ffe226a80e37ee23014da3081759dc9e2b6a6e2c4e866a995f422ff86ad3a785b45647716789de65aee1fb4307d

  • SSDEEP

    49152:C9H8NCp3AACRw8snELLxIAPKzCgZml0fvHFm4XNLMxyP5GkjeJBazGEH:McNCyzRw8XOAyPme3HM4FMxy4kmBc

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2