Extracted

• • Target
    c5a44d49487fc4ef176fab38c0761607e5f1005588079b1ccca24f5b11bcbde2.exe
  • Size 2.0MB
  • SHA256 c5a44d49487fc4ef176fab38c0761607e5f1005588079b1ccca24f5b11bcbde2
  • MD5 fe4c1aa2eebc57c4d40a044e96f5d487
  • SHA1 aa76ba4df9b79489d59d547e58720d015d6d2c98
  • SHA512 c53cb703a60672c742d5a9b1d7c878d6780f6b76998204138c93286efd787b052a0b1c261fb2ebcbe7f73ecc2488f3a22a478e1d8660facd3ddd989808f06caa
  • SSDEEP 49152:32AgRwW0LztkRUZpA6DTWt8C7G1lW2sKwTIAM:mUEUZ++2a1EfXM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2