Extracted

• • Target

    55d05fd5a19e6c9163da28136e8f06f9be8654ef3099af24faa8eeb5345068e9.exe

  • Size

    1.8MB

  • MD5

    8547adaf86a7ab657c3ae9f8fe0835fe

  • SHA1

    4202647cf87c0263ad059f30b06b04f5d8a7e8a5

  • SHA256

    55d05fd5a19e6c9163da28136e8f06f9be8654ef3099af24faa8eeb5345068e9

  • SHA512

    336b7fcc843a253fea60526aa1800160fe27969d757edc52e22d7e8e290ebaf02921d3c5c5b8435ca7da6fcc1227e5e25fa4d21b49b459394b412cf53b0cb8e9

  • SSDEEP

    24576:CQiNPbM9CTnh3cKwuy9UkfYvqrv6vN7XJshb+bQrMeTx0dyWZlWHXl7zX:C9xM9KHgzv6vBar7xXuKX5X

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2