Extracted

• • Target

    f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1

  • Size

    4.8MB

  • MD5

    1d7d3477c7968ecc9e9bbe0f0bf9acff

  • SHA1

    d4fcda77873baeef4b870dde9fa74cf49a6fb833

  • SHA256

    f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1

  • SHA512

    e7c90163aca05a530f982c002fbac1ca2da126b8aea2177fcec303952ad06b681fde5899945d40f5e54d7df14a2aafd4a045d256328c71bb46cb6966ce71f14b

  • SSDEEP

    98304:+pmDGs/wmVFG+IoW2GZbyDCyxaSBUdPOJ8CYVSPsaNZC3FtlAd1Zcs:i0LRGxynaS1LY6TNSKXcs

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2