Extracted

• • Target

    886dda8cafbf6199ff14a921a5711ab8b251d21dde8a9fa7879e0e05e498d4ba

  • Size

    2.0MB

  • MD5

    0996a7865209402a8fb79ebec17baa7c

  • SHA1

    005c42b705446a9b9bfa2e4505860867e7027d46

  • SHA256

    886dda8cafbf6199ff14a921a5711ab8b251d21dde8a9fa7879e0e05e498d4ba

  • SHA512

    eb8153cb1b45dc6d448bef47bf64c8d2a5c3676ac1a509c1d2c5286d46b87b69e8a137ff84591409799249422934261f4e7bf215ac04386b0f1be6ff179eb479

  • SSDEEP

    49152:32JLcDsCVl/1XGavcEdwLX68K1zR8G0HI3ulFqGn9mt1ng:miDsCd2aVdwLXO127lgGn9mtC

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2