Extracted

• • Target

    9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613

  • Size

    4.3MB

  • MD5

    30ed0c72a440bf71d20c043c41db140f

  • SHA1

    4f3b131808f42ef6bb7cffea741c4f274e83ff68

  • SHA256

    9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613

  • SHA512

    a8abf64bc8a3c6a3ba227b9592ed03d89df2444673523966b73367aa386714eb3dabdb4dd9ea3c14bd93a7077676f586ed9bcb2c46657268f9e592ce933f1156

  • SSDEEP

    98304:ioju6pgiNseCvLbrg5IK+rrFicqXagwdG/a0e9JdQDBtXOzOcFT/3TNvSt:/jLpggvCvLw58rZicmRwwCDJi9YnxRv6

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2