Extracted

• • Target

    960dce369bf0ee060ce3f5c32589a081075b9ae9123a23ebf69490f4d52f1f26.exe

  • Size

    2.5MB

  • MD5

    23caf06fd127424abe806bf1a94a8074

  • SHA1

    149576b82156776b92a971c6c306a66f36b0b91b

  • SHA256

    960dce369bf0ee060ce3f5c32589a081075b9ae9123a23ebf69490f4d52f1f26

  • SHA512

    b184c1d27befdffc9ffbcff3adbc98e6d1157e6fe2c9a42bcf24ee366f05a81556570e20d1dd0d816d84e72c67be1ba123c42a7b32fac617a2287c1fde561615

  • SSDEEP

    49152:C9JUzBM3/r8AGfg1dk+Y3WOfGRF6qTeEZ/wIwrWpD/t6x:MJKBUGIPk+8HuCqTbwy/tk

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2