Extracted

• • Target

    5cdf313b385355057ef6dc1a7ba290c0454546e837b431385009d81fabf30153

  • Size

    2.1MB

  • MD5

    2ec36709a26c2576766f44d84fa98c67

  • SHA1

    8187dc93fcd1a04272056698330ac3470442514e

  • SHA256

    5cdf313b385355057ef6dc1a7ba290c0454546e837b431385009d81fabf30153

  • SHA512

    f9cc0e716f9f1e7c77eb59a3cb76f5fe18d8881367219268d82cdb9a9ff0ec2714ec0d72d152364c6968189f5674fd239c22221172a6852def54f527863df714

  • SSDEEP

    49152:32mqQr/QvSuhBFLfiYgLqC+c+EG4lUK7LoGOa:mT2WnbC+c+EN2Koa

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2