Extracted

• • Target

    94ef5101cde7d098dd54960944472039cb09d53dbbf1910589faf6af4eb8b419

  • Size

    2.0MB

  • MD5

    4c283a1d647d7f2f7bf519baf4c0aa42

  • SHA1

    7ca9f28831bb1ba1717090da339989f620f64aab

  • SHA256

    94ef5101cde7d098dd54960944472039cb09d53dbbf1910589faf6af4eb8b419

  • SHA512

    5e0dd639d9bd8ad97a24873dc0b402bc216357ad8b5c3f6b2007ab171e80e517a59424a5045c51c5280095e1b9589045cba2c9bef8dc8e29e43d93f7ec1dde35

  • SSDEEP

    49152:C9IXdFViwFOrAcjJI6tEmAvsBz6+X6NCD375:MEXIvO9mAvsO3NC5

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2