Extracted

• • Target

    195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5

  • Size

    4.3MB

  • MD5

    75cab99147852b877aeec544e91fdf03

  • SHA1

    da7ce098bd485975f3636e8992a134add49da77e

  • SHA256

    195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5

  • SHA512

    acc1a3a44c2fbeb8438e7be9e9151fd6115953e0ec767a7a2891b96dc8ea2ccb9dc2c4c4d8e13b37249879e53748571dd3d1b24816bd338369824869a083d20d

  • SSDEEP

    98304:KvmGccy/z7hh0+JcCfZj7l4+bCJAenKKLunqGTJ2x8lFBe24xvl:0mhxC+eCfdRbCBnKHPJwI4vl

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2