General

  • Target

    db61ce99227a8d682bd5a5dd24eb205ddf37e13bfcc0bce109ad726cb7d9e071

  • Size

    5.9MB

  • Sample

    240530-bg2tjshg26

  • MD5

    1d984db07e898bda91ea4a51c57bc3d9

  • SHA1

    4baec772db3c837d57479f6ef92f912bf9dae20b

  • SHA256

    db61ce99227a8d682bd5a5dd24eb205ddf37e13bfcc0bce109ad726cb7d9e071

  • SHA512

    338094fab941fe7e4e30b6ba0fefbf49941c56ee43f2e351cc564c5805802152143c75067d7d083aad96428994fda45e4b8b5a69b3e4d94d276c9834662c2a46

  • SSDEEP

    98304:mTsYbh85zwS4RD/94aOZP9wHgtyqYKfhwznjZMyZFuNWveUtMiKm3Fr2lEnK:Osi85z8gajHqpwzjTXu8vHtMA31qEnK

Malware Config

Targets

    • Target

      db61ce99227a8d682bd5a5dd24eb205ddf37e13bfcc0bce109ad726cb7d9e071

    • Size

      5.9MB

    • MD5

      1d984db07e898bda91ea4a51c57bc3d9

    • SHA1

      4baec772db3c837d57479f6ef92f912bf9dae20b

    • SHA256

      db61ce99227a8d682bd5a5dd24eb205ddf37e13bfcc0bce109ad726cb7d9e071

    • SHA512

      338094fab941fe7e4e30b6ba0fefbf49941c56ee43f2e351cc564c5805802152143c75067d7d083aad96428994fda45e4b8b5a69b3e4d94d276c9834662c2a46

    • SSDEEP

      98304:mTsYbh85zwS4RD/94aOZP9wHgtyqYKfhwznjZMyZFuNWveUtMiKm3Fr2lEnK:Osi85z8gajHqpwzjTXu8vHtMA31qEnK

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks