Extracted

• • Target

    0b0191e2d45431472e9d879ad081b8479529bda2a2b126dbb9e8460560a2f901

  • Size

    4.5MB

  • MD5

    238119b18020759d00af022d44de6d03

  • SHA1

    98e1c827677d9a4c39165bc9e2b64445ea6d7be2

  • SHA256

    0b0191e2d45431472e9d879ad081b8479529bda2a2b126dbb9e8460560a2f901

  • SHA512

    5826cc6b7e59eec4aab27576b5a4e2712a961dcdc97f715643239c9aad2d717a80ecf398b447ffdbd96720de9489f5bfbd2a9b18a0a3011032360c9e64714297

  • SSDEEP

    98304:7akYZz+Kgp/u23HQ+P6x19SgBhZxDLn3ZXKIVsPHgL5938:1BKVUHBQ1wGxgIVsPy9M

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2