Extracted

• • Target
    52c54837a3266152e33427c51372a05e5d88906e65930733b8443ac05b92b4d2
  • Size 1.8MB
  • SHA256 52c54837a3266152e33427c51372a05e5d88906e65930733b8443ac05b92b4d2
  • MD5 dea7f3bb0599dd81ba20579b0189e019
  • SHA1 88890c89b25fa9c7913e59c9fa8527c6b90d0f75
  • SHA512 bbdea27133148f730b31a8f301a3e918f158153eb9d6089e186d4439c75571f1855d0d305dce84d139e1ed01494594a20fe5f94b90daccb8bda2d96ac90d448a
  • SSDEEP 49152:32xqb0WUDe0oQRq7dlLZ04HbepPUSAXunZyJTbi8r1:mAbDgRVq5lLZ7HyWRJy8r1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2