Extracted

• • Target

    523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42

  • Size

    4.3MB

  • MD5

    bc04272fdd34fd409d1226d33310695f

  • SHA1

    84b12d279399b993308799218fd1879d11051c11

  • SHA256

    523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42

  • SHA512

    9ef238c2c28cc9ea49ae98bd8af74af628772637e1d4a13f7100e3a1b5bc34f37b8a53944e922782dfecea11cf7d56451ea4b40a09f9e86365bcb541581d9adb

  • SSDEEP

    98304:0KAtrBEcSjDDaf4d6JeGDwG9ObQjvkL/o6lgTw+dhOMRwhr0QVpvl:0VS9+fWmtxO8C/SE6uhr0Q/vl

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2