Extracted

• • Target

    397e125b8792247f24c7e63145461ef7ca5577e611cf81681cdc84567a90878f

  • Size

    2.0MB

  • MD5

    4f5a4adcfb920c76674c95717d8643b4

  • SHA1

    11a86a9430fddde287a7c1d5b4cefb8db4fc3e3d

  • SHA256

    397e125b8792247f24c7e63145461ef7ca5577e611cf81681cdc84567a90878f

  • SHA512

    cc6f5331d483368ea2f2bd4e24233f27521e9b96747eea567863751dafb646cd9a2a0df19f0b7c46ca540bd44953052d16cf330363f6e4f7b8c4189229fb0c56

  • SSDEEP

    49152:J2yVWDv7eHOCxx3srLG5Bg0t6VCvPYd7fN3F+nlAhmd/ljj0blHn1/:cn7MOcx3srOgVCCzhmjQxV/

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2