Extracted

• • Target

    728feda20379a4afdfa19b5c66b346aed6858511a115e72d1c54b8311746644a

  • Size

    5.0MB

  • MD5

    8a5520c0588c04813596aa5679a2b466

  • SHA1

    a29d8da1e893ef4332fbcced29950688ca0e1953

  • SHA256

    728feda20379a4afdfa19b5c66b346aed6858511a115e72d1c54b8311746644a

  • SHA512

    d14236913a3cbdc1b171a3cc124307e8d0caf98e90f2bc54f32d61c4c3fcaa34f6f04d85651747d1ba71ef9b6f6e549e6b48070d75b3bf52653aa6abbf5e4959

  • SSDEEP

    98304:+aMzvwdkwLwwwPaNBcom3LlBQ70CpGqIbZWyUD8SoucbGWuxCd1Zcs:PewLwiNBco0LHQjpLrkUwGryXcs

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2