Extracted

• • Target

    3e2ae3d3f36e34c8e8601cb49e3f649c9b85ee3586e9771858d0d2a19c513705

  • Size

    1.8MB

  • MD5

    4ee51ef6e6e2091156e2e2b54890282f

  • SHA1

    dfb98a12088a4515e967533b05d0af9793caf859

  • SHA256

    3e2ae3d3f36e34c8e8601cb49e3f649c9b85ee3586e9771858d0d2a19c513705

  • SHA512

    02ef3fce9b5403bbcc6c857b6303ae057e1d3d1e87053691a577cabef80a5561a1078ad7e99a8e2f2b104a7358525f3aa1d2909c3d01226a0f2d5c588598d399

  • SSDEEP

    49152:326vvqpBWi05bEvWvQaTWn1yCeu14RaqoUpz:mEvqpBIM0FQkCYJl

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2