Extracted

• • Target

    ef63432fcc2deb1e1fef4a7fca19f0a9332f0c373963de4db3b05f2571ff228a

  • Size

    1.8MB

  • MD5

    433a1929419e3b80ed0ea666aa5d2706

  • SHA1

    415c7b43c455fc91ab25a7fc4812e9ecb6cc4b65

  • SHA256

    ef63432fcc2deb1e1fef4a7fca19f0a9332f0c373963de4db3b05f2571ff228a

  • SHA512

    bed84995c8b694d5a04914dfaf19eb09d6024646e71aab0e988ccd599600b0ba7a4bbbe72d75c475244af77c95ec5d79d7bd174a65f042c09c9ac8e79d943b21

  • SSDEEP

    49152:32OJQI7/+NtzH4d0ZukosqI4oVw8j6KgKNB:mOJQIaNtzH4dMPPrw8OKJB

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2