Extracted

• • Target

    c1eff3689daf9190061421fb035524f0.exe

  • Size

    4.3MB

  • MD5

    c1eff3689daf9190061421fb035524f0

  • SHA1

    ac5efa73953901ea5f4098fbf4be9ac97cc27e9e

  • SHA256

    60185ad4f1d262dca113cdfcc63ff8eeeb576782adbe31d9aa4b10dc73c34109

  • SHA512

    4a933c6daafc69a003af62bc726e5ea4b043d2b6e492f863da74f44273c3a7b9fee41040389882ea54f369a3a98cb067eab048741868656bad73ae53f72db767

  • SSDEEP

    98304:0nVYRi5VeBzdPpVKaqSdhF4I9NbjehrrsA510z43h9sonEQxu:KVY2Vetdu0hF4s3qrrzf3hyoEQY

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2