General

  • Target

    add534d0b66febb5af5b6a9c329023281d77354ec017f469c1a5deeecfabb89f

  • Size

    4.8MB

  • Sample

    240530-3b8hpadh3t

  • MD5

    0d3c958d2f04218951a3cf02f5062cda

  • SHA1

    6fd36e757709def61f1f5b1143d92a84d5a00d15

  • SHA256

    add534d0b66febb5af5b6a9c329023281d77354ec017f469c1a5deeecfabb89f

  • SHA512

    8c699cc7abd944fea525dcc1abc6831f4a4d375337fe51c4d5791b8b5f110d5146d81f04d42446ee38ccca20c2abb1414b857e9b9e933a876e43835b99a02a05

  • SSDEEP

    98304:ml7EqrUJIRBWAevZ39D3H/m0jxw97OEhE+GHK42OgcKYJl0b8b/:/4UJIRPCXfjxfEBGHj2PPIb

Malware Config

Targets

    • Target

      add534d0b66febb5af5b6a9c329023281d77354ec017f469c1a5deeecfabb89f

    • Size

      4.8MB

    • MD5

      0d3c958d2f04218951a3cf02f5062cda

    • SHA1

      6fd36e757709def61f1f5b1143d92a84d5a00d15

    • SHA256

      add534d0b66febb5af5b6a9c329023281d77354ec017f469c1a5deeecfabb89f

    • SHA512

      8c699cc7abd944fea525dcc1abc6831f4a4d375337fe51c4d5791b8b5f110d5146d81f04d42446ee38ccca20c2abb1414b857e9b9e933a876e43835b99a02a05

    • SSDEEP

      98304:ml7EqrUJIRBWAevZ39D3H/m0jxw97OEhE+GHK42OgcKYJl0b8b/:/4UJIRPCXfjxfEBGHj2PPIb

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks