Extracted

• • Target

    fe41fabf9b409eadae90acce6534b28c.exe

  • Size

    4.1MB

  • MD5

    fe41fabf9b409eadae90acce6534b28c

  • SHA1

    0a7c4584463ca92af674c13c77eec6e36e6edce0

  • SHA256

    7e847076f8560068061420c672135ddcc99341b0ce5d80b5c98f234269d55b3a

  • SHA512

    97667254349af306a2582541d45ff2c72732c84f5e2d1f1627094ff3a47b6da7836fa7c27c742b01b329abec8c99c31f27ed1bdbb0a4a3fd8e494c49bb40cf03

  • SSDEEP

    98304:C3RZmPti/MAfokjLwxBiSdv4cCHKA6cUy5dCjwtoznS2QxX:mZmslNHPnqA6cFMKb2Qh

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2