Extracted

• • Target

    0d66db2edaa5303ac836ad553f1de9497ea6d7f60bbd5aadd007d2dfdcca817f

  • Size

    2.0MB

  • MD5

    1f8c88ad981403b14bbdb69498cd5ddc

  • SHA1

    54941bf7fd07b2c07411ffb97f165fa8228d5544

  • SHA256

    0d66db2edaa5303ac836ad553f1de9497ea6d7f60bbd5aadd007d2dfdcca817f

  • SHA512

    94aeced72e5d12e1fae4c5bfcbeeeb43b9c85998c48d266a7d3b34b29168f2ef5cd5fed240e8be735a63b6cc302187e1b5f85c033151569adf4cca1517c96e48

  • SSDEEP

    49152:C9GZDOg/30tX+5DqmcoFOEjcVwc+zcmt8f9UHvZd/LL8H:MCR1/S0zcmt8f2vZdg

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2