Extracted

• • Target

    bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4

  • Size

    1.9MB

  • MD5

    609e4cc900279674a71b4c70e42b5cf4

  • SHA1

    7c2ba9b3c0f8da0551d83a43f1c742ad00156d3c

  • SHA256

    bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4

  • SHA512

    a21dcce16545a907abe0cad4833148c85f21c44d787ce6d9a46074add691235aa82a4fcf3a455949cf0e8537dfdd5abf58fc9d7c16117af9ba7ee4d4b51e48d2

  • SSDEEP

    49152:C9svreit7n2myw9Hn4knjqZqAr85YE1IUufLyO2:Ms60n2w4kjUqArqV1IUu4

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2