Extracted

• • Target

    420937a5f19ae02fc11ba9407ba4560e2298131fafbc3d19e5267e9a67630365.exe

  • Size

    5.2MB

  • MD5

    253e324d58c3a337d3e4eb594debc611

  • SHA1

    462c847edc0d7b2f9a2a4bb352e31c09c6658521

  • SHA256

    420937a5f19ae02fc11ba9407ba4560e2298131fafbc3d19e5267e9a67630365

  • SHA512

    152fa74ce37f89aa2710aaf45a19cfc330336ca0c6c5a5bc27a27719a5291099817995cdd044c620b724e430ede031fdc1c1bfa31a803f672cb92e8234b717d4

  • SSDEEP

    98304:+P6cR94aMSjhhZ2GVx+DUU4sSWUz5b3rHhmGfSkXHo8OKGUGBAUCWXadwU9XZUfL:+j6ahtJVwUMUdfHht9OKGjt0wUdm1X9

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2