Extracted

• • Target
    1a74a1dc13d716c72f5404866fdaff2f942856c38a795b15b2a464ddb52f12c1
  • Size 2.0MB
  • SHA256 1a74a1dc13d716c72f5404866fdaff2f942856c38a795b15b2a464ddb52f12c1
  • MD5 8bac5104c4ad130de57f7634d4ea79c3
  • SHA1 1362f2028c43c535b8f6f9ff57dbb6763449cd31
  • SHA512 af42253b07152daa477e2ae3a63fadb58608249ee33d340a43aa8ab69af1fac1526f8a36bbb406e6cf1cbc50dda07d92eef26014175f36c2eab948f02c48da4f
  • SSDEEP 49152:32UFtDt9/dtmYRNU3uU0ENoMd2vRE8mg+z5:mctPFc3ucNoMd+Bd+9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2