Extracted

• • Target

    08fc98ff08fe889ef2be12ecc56e16aac795a4874b9c1c37b1b7d0d8fb207f8b

  • Size

    3.7MB

  • MD5

    6b5899041652efc13c1990b074cd7fc9

  • SHA1

    ec1902e8b3008c363632f0a91aeebd67f3d2501a

  • SHA256

    08fc98ff08fe889ef2be12ecc56e16aac795a4874b9c1c37b1b7d0d8fb207f8b

  • SHA512

    cc0b882e45fe8f21295712e0345fd14c3f77414cfe821c3ea8cc3a8e3486753a7fca991c2a54dba6915ad853b15ac832e7ff0c732eaea8daf0d7aad5be3d11e7

  • SSDEEP

    98304:CuzzeZnWkxTw2d2OrnxfErBoXNw0RLPV9:dzYnP1rxEAzPV9

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2