Extracted

• • Target

    c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b

  • Size

    2.0MB

  • MD5

    cc2436628125a7a1ec85f26467de79ef

  • SHA1

    d49c3f7993f957a5f5bdc6ca8b398660e4e5961f

  • SHA256

    c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b

  • SHA512

    ce8229f466b801c37b7760e8cffdc768133e376a72384757ef5a7682ff0d5e4065a276436ef206d2b8aba629b2ad31621c3450800372cf15de204359cb49524a

  • SSDEEP

    49152:32ABQaqBz4mnA3PvTTB02+KbCt+h7/KxbLJbwml:moOzFA/b1bQyb+byml

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2