Extracted

• • Target

    7484a00d6f2ff6d6b86fb1e72beeb94578e3b2e2895358f49ac92b409990496e

  • Size

    4.8MB

  • MD5

    d03dafc548d68c981a8b6c43841ae5e5

  • SHA1

    455eb56111122c1dd5113707af830cbda6415baf

  • SHA256

    7484a00d6f2ff6d6b86fb1e72beeb94578e3b2e2895358f49ac92b409990496e

  • SHA512

    c40a66958edbc2d9da716131fe10576e50f1aeb2db455da030a31b741f7f3729e1a06ad3a448c28fe0c33022f1a727b19bd23bc978a7e1d4d5bdd8c595681867

  • SSDEEP

    98304:mly6TB2ECUKopBd08qgovII7kFXf34Ek/ezzc4FFWYGpSlHWM:cdl2jpI708zowI7kFXwEayc4zWYGpSlZ

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2