Extracted

• • Target
    SecuriteInfo.com.Trojan.Win32.Crypt.22353.9204.exe
  • Size 4.2MB
  • SHA256 44a806d2a1986c2751af875e9f95fe6092ff7defd3a41475d2bda32b8762d2eb
  • MD5 1b3322b13e301d137ccb9627655cc637
  • SHA1 92583f21f59fd94a62d1c43d0873e25110a86375
  • SHA512 b6f88684d75c6c6e3c0f4285e92f7a0e0acfe2d6115848c5b34ae63cd38c91a8cb0a6cee7dd9d7510e410209857362c51b5636935fbe2c753d3577a3b5adff8f
  • SSDEEP 98304:CPPIWkbJ4K3XgvM3qPf9VQ29dhIcOdlLfeqQ0kUFD3rxQxU:x7XL34f02XhIcS1TQ0D3rxQ6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2