Extracted

• • Target

    2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe

  • Size

    5.2MB

  • MD5

    ea722aba6efcab9f9bdd63feea339054

  • SHA1

    6df0048500b44c2bf6d184fcbd6effa79ce9353a

  • SHA256

    2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08

  • SHA512

    1e3b756d7d997ea1a2a2804427e2b9b78541ca21b400a13471af100bd489d2df05e75797487a0a48192df79a919ceba2c3b3580a39294bdea8c90412378895a9

  • SSDEEP

    98304:mM/yobaLdRHCAgX+v2Oo3Vf0wN8cLdIpKW+afjWLABe56h5zEnPowDW8/2:D/yo+LHCAgOv2Omd0wNdJIwWLrrBe56/

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2