Extracted

• • Target
    f0d829da8c49ddbc0b18182298fa6b0e.exe
  • Size 4.3MB
  • SHA256 1655119040883feb256b1645581f9d7884a7c8e157d15fd7ccbc923d7e8a7778
  • MD5 f0d829da8c49ddbc0b18182298fa6b0e
  • SHA1 e78451b67c97520fccc17af3e82538fc2505e018
  • SHA512 54887b656679e8b089408c0a8e0ea33e4f09220f86a939cb497a5e998fbeb139b434a07a3f5ff757d33d8904b8778f264a0687668c842a0e8f8f86cb414ba9d7
  • SSDEEP 98304:CZNsudY6DH2dzlwy62GRmKoO//mXLwQnbMo+5ZBNQx6E:CNsqHizQ3bZANbMo+5PNQP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2