Extracted

• • Target

    8b77947d65021b173b7ce54e0cf475a3cb10afe2c06033b5961cad4b87b6d71e

  • Size

    4.3MB

  • MD5

    dad08188a8248ac82a09a1f6407c2a76

  • SHA1

    e0d8e00ddcea83ed88ee025b99a02b0da2c060c5

  • SHA256

    8b77947d65021b173b7ce54e0cf475a3cb10afe2c06033b5961cad4b87b6d71e

  • SHA512

    30ea465e292b2b20edb6b891893b3fc772c684a693e701eb4e93ba089447a588563809cbf55fdd20d767b0f3a776f22964faf66c80302e3beaac9e4aaccc0485

  • SSDEEP

    98304:K+2LvaI5d9Af/NBHshBlNgSDoEq28neBYUmZcvl:KjLpPwnMf/LoxneJtvl

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2