Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    16e0fef131c34d95ba6611400399c7ac46c1a8db8052b91a2c9af32534d3c825

  • Size

    5.5MB

  • Sample

    240530-2jm2aacb3y

  • MD5

    91a41fd0df10dd851715588c0d362cf2

  • SHA1

    2cfc253b6b03518eb562877f2cf69b74f8eb36d3

  • SHA256

    16e0fef131c34d95ba6611400399c7ac46c1a8db8052b91a2c9af32534d3c825

  • SHA512

    d7902fe685c8c7d4a184490381aa3f3892be67c0a23fd6c3caf96d36f67f15fa0013c15ce8715be957ebd3c32bd470014447038a7fa8599291cc9e227a97c99e

  • SSDEEP

    98304:mG3jaDxNVESmoeafm5xtViQIszuI/4df0ZDytLwBRy/rM3i6BFeuZL0KoGk23:5zajS9su5DfIwuLdfXAyzix8uZ0Kop23

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      16e0fef131c34d95ba6611400399c7ac46c1a8db8052b91a2c9af32534d3c825

    • Size

      5.5MB

    • MD5

      91a41fd0df10dd851715588c0d362cf2

    • SHA1

      2cfc253b6b03518eb562877f2cf69b74f8eb36d3

    • SHA256

      16e0fef131c34d95ba6611400399c7ac46c1a8db8052b91a2c9af32534d3c825

    • SHA512

      d7902fe685c8c7d4a184490381aa3f3892be67c0a23fd6c3caf96d36f67f15fa0013c15ce8715be957ebd3c32bd470014447038a7fa8599291cc9e227a97c99e

    • SSDEEP

      98304:mG3jaDxNVESmoeafm5xtViQIszuI/4df0ZDytLwBRy/rM3i6BFeuZL0KoGk23:5zajS9su5DfIwuLdfXAyzix8uZ0Kop23

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks