Extracted

• • Target

    6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2

  • Size

    4.5MB

  • MD5

    250cc589c3b8b0518e356c3f70a68510

  • SHA1

    1912bc4cea5800fce1944c334b2e2fff74c3e41c

  • SHA256

    6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2

  • SHA512

    418c9d19940d5ee11d92feefa813f94aa196aea62f6e6c2ed3caebca632091bd38a48a126d451ffaa873fc1dd14b505e6200ff32253293419828b2dcbd7b82c9

  • SSDEEP

    98304:7aRRFqMvmdMRzovbRQQetMeuRHmV/n98eIN1nw2qaXi7f5vNTPkr:M+NQSeuRH2/n6C7wib3TPo

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2