Extracted

• • Target
    85917d7642441b2dd154e505751f3320f7bffcd7bddc7cfcb28be79333ebeee1
  • Size 2.0MB
  • SHA256 85917d7642441b2dd154e505751f3320f7bffcd7bddc7cfcb28be79333ebeee1
  • MD5 a3084feee48f4ad428b413f50b23696c
  • SHA1 0b93eb00ac8cf2a325db8a9337209465000a394b
  • SHA512 84f9c505f77ec8c6b2d1d5304b8dc41e6248e6af1d5b0d95f9cbb8acfb05174f98ccde0a2d18721179d50f8548571ed2435519e955eafe286ae5a5b1fb47108c
  • SSDEEP 49152:32znypOfPJvcDiPu49QoFQ5g3TcBv+rw0Hul:mzySJvcW/FELV+rwoE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2