Extracted

• • Target

    38214742b681e9720ad4550771f6a8466246ab5b69bdf373c6089acfb7a4c6af

  • Size

    4.1MB

  • MD5

    fff384803e0be0f3a12557139baa2dac

  • SHA1

    16148543c09ecb515d422210a361fe812ef6a9f7

  • SHA256

    38214742b681e9720ad4550771f6a8466246ab5b69bdf373c6089acfb7a4c6af

  • SHA512

    f02f4a68534f17a2631b9fbc6d4d18cb50ddcac820a9ada1405ae844abad92de866ecdbc8d12cbd233111a740e8c3c108f6bd4a1e01f5cab3ca0a79ea5ab87be

  • SSDEEP

    98304:0o2Eg5NafGQor61Q940+wls9DnR5+U9LFYwLMgvSt:b2EkNNeq940+JrR0U5Ddv6

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2