Extracted

• • Target

    SecuriteInfo.com.Trojan.Win32.Crypt.32471.3146.exe

  • Size

    2.0MB

  • MD5

    e771b3e8f5d1edff5abfff3baf6e712b

  • SHA1

    02c048112d45716ff703207d041ddebcd7d961d1

  • SHA256

    659240bbe35456b042af8a30ef5c786b65ed084de60d7a9ad0a286f6eba884a0

  • SHA512

    7c0a7d288ea558e30d0ca7b61566b37247d29be60e211be157b7a4b33e42461f46b982423d54fa11a13717df5be8f063ca51a627813f79afa1a478b40d8d4bfb

  • SSDEEP

    49152:C9r4Y1ZSgPogEV+goIDOxkaliEiDmBctvRnw2Ihi9rdE67kW5X:Mr4gcfdDOTvBCpmgRT

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2