Extracted

• • Target
    eb12d8d794cf494a7c77e1b82f4305f7.exe
  • Size 4.4MB
  • SHA256 b409d205ae446b7ff2507e7ff4b5b4c9b63d76df8cbcda30407ee4d3d2bc7ff7
  • MD5 eb12d8d794cf494a7c77e1b82f4305f7
  • SHA1 99e544894151cee23226915df78bed998ea9eb5b
  • SHA512 cdc19cd890a27313eb0d287a519b4e11c2557a03da5a7b3c12a8c7fab9a21ee237b1e0051a4a68e1e771c769247d204bf325ad42c8bf2f95f446881fe11b7a92
  • SSDEEP 98304:C/cRIqQbhWAli4o8qc/Ufy/F8xlz/FS7WyXtvSe0tpQxU:WlUAly8Yy/GTk7WQ+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2