Extracted

• • Target

    b16dad9ce537f49e29872d097cd90cb47878baa40c052148399634d3b3c256d7

  • Size

    1.8MB

  • MD5

    a69e738f1d163210908802e031a8fc59

  • SHA1

    19f760fdf998f5b842115055c486185831fd0389

  • SHA256

    b16dad9ce537f49e29872d097cd90cb47878baa40c052148399634d3b3c256d7

  • SHA512

    b6297ff9189f278592b4bde0331110f900b6cd3625f64c9de8c9d0cce4ea16284827480897f69eb44775e60f3e55ecc53d6129b4ce308314464e75b228ad0032

  • SSDEEP

    49152:323no3cB1yTThNHNcD5LMRbcbHt5qmg4pz:mXosBcNt4Nom7l

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2