Overview

overview

10

Static

static

3

49bb3f103f...cs.exe

windows7-x64

10

49bb3f103f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49bb3f103f957e0813d235ff73eb36852a72db76af92d411b3c1c6f9135f964f_NeikiAnalytics

  • Size

    5.3MB

  • Sample

    240521-pkdssadf5s

  • MD5

    6de07f95b1a7b73895cd2123edef8b2f

  • SHA1

    3944faf0df88d15be1cb3f66839c6bce0ed6b37b

  • SHA256

    49bb3f103f957e0813d235ff73eb36852a72db76af92d411b3c1c6f9135f964f

  • SHA512

    a939c59c805aaf744d1d5873faf4abffc04905e4469054a7017aeb78257acb26fc252493ffa715b6ca6f83ede15b2edffa0ad28c0328399430e6124b3f7ab8b8

  • SSDEEP

    98304:mJMwLD+ZNKEPm7oU5ORo5sPxDCzpDGREJY6I8WGLdRaj9X3s4sMCR:XwLD+ZNTP+ot0sPROtGREJjLRajp3s4K

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      49bb3f103f957e0813d235ff73eb36852a72db76af92d411b3c1c6f9135f964f_NeikiAnalytics

    • Size

      5.3MB

    • MD5

      6de07f95b1a7b73895cd2123edef8b2f

    • SHA1

      3944faf0df88d15be1cb3f66839c6bce0ed6b37b

    • SHA256

      49bb3f103f957e0813d235ff73eb36852a72db76af92d411b3c1c6f9135f964f

    • SHA512

      a939c59c805aaf744d1d5873faf4abffc04905e4469054a7017aeb78257acb26fc252493ffa715b6ca6f83ede15b2edffa0ad28c0328399430e6124b3f7ab8b8

    • SSDEEP

      98304:mJMwLD+ZNKEPm7oU5ORo5sPxDCzpDGREJY6I8WGLdRaj9X3s4sMCR:XwLD+ZNTP+ot0sPROtGREJjLRajp3s4K

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks