Extracted

• • Target

    5033237eac5a71a2a291b97555df9f3d3fb02f0342f95ade5d46ab0f9dd71dc6

  • Size

    4.2MB

  • MD5

    22cb238c0068d06a64d0b3725d2a6fc0

  • SHA1

    83f427958c95b08a67b0bd6a85d7e81610f5a4bd

  • SHA256

    5033237eac5a71a2a291b97555df9f3d3fb02f0342f95ade5d46ab0f9dd71dc6

  • SHA512

    b55ffd92203b0012a42de7284ef9793388cce3ca2284af0d531e67c0d7a8399fc52f534fe11f5d0a7d6d836ce8a4569b3e25e94172e07884551212f34bb50f5a

  • SSDEEP

    98304:p7HuwJs7tR4MOrFVZ/gZEaZjQCOIxdFyK87odQxF:NXUtRJEZYZEatMkdFyK/Qf

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2