Extracted

• • Target

    eb172af483fb9d1e49d9248c596b3c9509a5242b3ab97e8f5c1c1b6eea7db6e3

  • Size

    4.2MB

  • MD5

    8b7c0764f9293dec5688505075303945

  • SHA1

    1fac6a753a99d922c7b92cdd748444393bcfdb25

  • SHA256

    eb172af483fb9d1e49d9248c596b3c9509a5242b3ab97e8f5c1c1b6eea7db6e3

  • SHA512

    56009b4bd041d11d98b4f278da60b2a915411bf8d525c858ac9121581c4f80f2d25add77045105c210b7ec4d91c3bc0cabbe40b5facc439c7dbc53927c02ebf7

  • SSDEEP

    98304:CHA4q3bYYNby+o6hUZnG2J86eUCU78hjGwB6bvsI+OL8fQxE:mrqtN2E2IUCU78hiwBfZOYfQG

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2