Extracted

• • Target
    abcfa05db7b920e8c58f2b5f5ca8cd7d.exe
  • Size 2.0MB
  • SHA256 e3afcc20063477edea06d401bc38833b8df4b3d17e44587ae2e0824a86fe60be
  • MD5 abcfa05db7b920e8c58f2b5f5ca8cd7d
  • SHA1 a713c9449deb2abdded1492211fab71a8f6c4d40
  • SHA512 613866e1526a79a0e9d9595d8838934c5e49ffdda98d535d032ff674d71f3125adea4f191830774f67bb30663defc21130274b30b48e19957ea08d2f40094199
  • SSDEEP 49152:32LDc21lbV67YHlBrnozO6e7i2vTSC01V+W4CSBHgRPb1jNlM:mLQ215YnPee2vE1V+W4CGHgRD1jNlM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2