Extracted

• • Target

    3c0e672bce0dad4ed808fc11657433c09a949dde5cb92cb6e3e9ca3b70d1ee52

  • Size

    2.0MB

  • MD5

    7b0450a8f0f55e1a4dd87d63c89391ec

  • SHA1

    07791ca729fe8530516a30cf79537851087e838c

  • SHA256

    3c0e672bce0dad4ed808fc11657433c09a949dde5cb92cb6e3e9ca3b70d1ee52

  • SHA512

    57c388a091fb1d381d6c5b6eb903100ef598e5abdd623508407305ac91a7809230d4733a354f61b0c79c8daa373f1094ec7a72471a423544d9d433776dd33466

  • SSDEEP

    49152:32wgMX097PjZYMpO6qaO9emlnq22+Q6NzFWatjY0gKNB:mwVgrZYMG9emtq2rQ6F8atRJB

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2