Extracted

• • Target

    1f78ffc413e1efc75cd0f9b48888f8675ab026f704dd4eb72346e7c8ee471ebc.exe

  • Size

    2.4MB

  • MD5

    9476e7dd2ebed54259ab23bc453bbc24

  • SHA1

    15ee73cbfbd9b69f3a7ef647c172f2af893ddffb

  • SHA256

    1f78ffc413e1efc75cd0f9b48888f8675ab026f704dd4eb72346e7c8ee471ebc

  • SHA512

    b769b193ad97283b7bdcc4ad19efa77d71f4fef6d222334bc9987227b7e43e77383646f0d860e3382385fc159d6116fbb08df6b29b2077262bda1089ff646f15

  • SSDEEP

    49152:C9A/wjF337k2wJy0I0X/sO6LoJCvnpmUN9sNsWaG3pQ/UXjH58:MR53r0Jp93Anp/DsTaG3pQMT58

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2