Extracted

• • Target

    712b40e35c119ff3900a1dfb374e1723b3020930c29c2c7ed5b54ed5ecd614f2.exe

  • Size

    1.8MB

  • MD5

    8112cdcf3e79a3a8a3216c6717a91783

  • SHA1

    a7f099c9d286e0e0e9a933daa7e6a9390c889832

  • SHA256

    712b40e35c119ff3900a1dfb374e1723b3020930c29c2c7ed5b54ed5ecd614f2

  • SHA512

    51d325a4ec08275a472e4e92ca6e40673e63f3da995c3ac7c8bec886fcacbba01f95f3cd6319d0bece8fb96074216f6ddb6aaf06777f0dfbc4a75b94685cf1bf

  • SSDEEP

    24576:320U/JjmoYq7FWknmfXBx2PFCnlK9oTD+Kl9iXCWgCReJdd18K4TIvjgvCNB:329Vmo/mvSPFCl46D+K8Ct7CggKNB

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2