Extracted

• • Target

    84618c5ceabf8ef658ed26ab983c27519b14eb24ab4df3eba1bf50d0b5a02fbb

  • Size

    1.8MB

  • MD5

    9e45fbb2a798108c2ee8d27588011ba8

  • SHA1

    9ee4b78e9db9487c1d1c06d16e46b0c6db52d102

  • SHA256

    84618c5ceabf8ef658ed26ab983c27519b14eb24ab4df3eba1bf50d0b5a02fbb

  • SHA512

    ce99bf97160dd7261dff8efd0094d401b3f22ff719d31456a635a072e19a51580351e60e7bd790bd41561ec6692b3443d46c832e3a87b5c1e056a01afb5fcf37

  • SSDEEP

    49152:32moewSVcbk+/8jslJQjVehYD5A87WilRnTgKNB:mmUsv+/XPvyNA+x/TJB

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2