Extracted

• • Target

    d2ed39089e227b666ba59e3633f130527ad867b708909b92b1dfad035eee1229

  • Size

    2.0MB

  • MD5

    1131307b7b2dcafbb33d1831ae5068cf

  • SHA1

    607cc040cef02dd3ba92894b078ef5186b2f7c38

  • SHA256

    d2ed39089e227b666ba59e3633f130527ad867b708909b92b1dfad035eee1229

  • SHA512

    37f808a45a7727a10944ea8995c4fc2fafc81159a459b808fd1f236155b59a13794526ec220fee78d64c93c32d412899030e790542b8e533bfd1801a061e69f6

  • SSDEEP

    49152:C9u5va1VlQbkaxRFRqvdthxF4F5lq2KbOPO0y9jr:M8a9WFRIdthxFclVQx0y9X

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2