Extracted

• • Target
    a50b54bc7a00fa494fff6d15ff3617ea.exe
  • Size 4.3MB
  • SHA256 934e794859a6e1d30d021f1af7b3a8b6ea99056bfc5e2cc1e9146b39bd07cabb
  • MD5 a50b54bc7a00fa494fff6d15ff3617ea
  • SHA1 a488bc484064dbb55d04cfd60343bfa132f5d4f8
  • SHA512 4d001bc2e3e6252e98890ea61b96ceff1aaa100071f006452f6ba461ac9c0b166e19b12272a575270231fd5473b792cb225bb27c631541fce5b25705d9f5ad0d
  • SSDEEP 98304:CofHhzzOSAGlMb8U4IHgG84P+fQmcqzL0nvtQxKC:JVFMb8i8bfc8glQsC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2