Extracted

• • Target

    e1bb37e9940955024cfb28f359da135788a97438853156ffc978e14f39a7f277

  • Size

    1.9MB

  • MD5

    86c2ded51a3ad876245df827a115d8da

  • SHA1

    02629b66a91f54cac78dc79331cda193673f7b81

  • SHA256

    e1bb37e9940955024cfb28f359da135788a97438853156ffc978e14f39a7f277

  • SHA512

    131a4d4beff4b0a735c9ae75d03e6d5ad1ebafc99bcac07073be88dd5968c0fec041da168bc88e757dc03439468b862549d30f6a689b8914a7764c440a0d154b

  • SSDEEP

    49152:32iGFB6xLUbL29RsAfg1yw2nnSsWpQeM9niqDtGyoU6eVXeURgml:m9UxIuVnsQnQ65XfRgml

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2