Extracted

• • Target

    42253ff18d5d70c19fe78640898d93ca712fe39d7e53b939138716b71e216198

  • Size

    2.2MB

  • MD5

    f1fb97a8723b3753f5d895fd486d4519

  • SHA1

    52815c506e6d8b1efd93087ef95642b3030713f6

  • SHA256

    42253ff18d5d70c19fe78640898d93ca712fe39d7e53b939138716b71e216198

  • SHA512

    facda49f4efc9aa246d12021da6620072318f24088d3ab319928245cd038ffe4ce6b9fe4697fa9bcb37f35e84a36c62b8f76f0fe8573def8aade309759d900db

  • SSDEEP

    49152:32miWIdYUJkCUtscwHtojpdYLM5uiR6927UnQhwG31gKNB:mGaXAyojMM5z6M6GwG31JB

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2