Extracted

• • Target

    7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe

  • Size

    1.8MB

  • MD5

    944763da3ca60554cc6befb9adbc4a8b

  • SHA1

    666a0b24de76ef9907a0488bcfce63ba1426b6a7

  • SHA256

    7ed000de7aa37968d95b86f688ab0b97219bd9ea686cb1cdedc861a687499180

  • SHA512

    a8ff0fb59214e39b69adfa206d6e21ed8584542fa45dd53af56ff6bb712c81d05bc72792b195f9c1602049d7202ae5d1f874a2d2913cbbbfe17a5212de22f1a8

  • SSDEEP

    49152:62r5Gxe+1W3rcbHvLM8oW1wCKOKKuhi4Ml2aP:bQx43raHjM8oWjUSl2aP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2