Extracted

• • Target

    2eda060aecf449871d3727f48dc3decbbc51574cfabf11dda96858c11b47a28d

  • Size

    4.0MB

  • MD5

    e0fe012f1b4e9cc9bc2d1f2c093f0221

  • SHA1

    b91b7bf760db8fa2dbd1a6084575dc2a8b21904d

  • SHA256

    2eda060aecf449871d3727f48dc3decbbc51574cfabf11dda96858c11b47a28d

  • SHA512

    2373965ac8706dfa037b13b1ca683e5aa3869758dce2ff74ce229fe953aff049b1a9c402c574975ae384e33a8d18d5b411fce11006eef3729778563b91229cad

  • SSDEEP

    98304:C4++Niesif6UR4ehJOcK7gzfYbP0oLC47n+g7CQxE:Drke/hJWJtlCQG

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2