General

  • Target

    490a74783ce10188e11464a95262df27a825bf9804b63c47d84a0481225dcd0a

  • Size

    4.8MB

  • Sample

    240530-f4n87aga9y

  • MD5

    c77c9ce1b1c514926abd59c2fc7a421d

  • SHA1

    c995eff569ac277b7be43fb616d1c85ff36de490

  • SHA256

    490a74783ce10188e11464a95262df27a825bf9804b63c47d84a0481225dcd0a

  • SHA512

    8eac79e0d35dd1dbc159fc34fb0730d083938a9097158094584dbfdb044dd93b5efa42a09c5d68ad88f5b56075649fa5e86dcd3d6f2fda63c0766ad91120fa26

  • SSDEEP

    98304:mhM/RqaAe88aJA+FSb5Bff2BQC1jIskYoDEB8bHkE0Aqpz4NDnGQ6:B/URe8VJ9FSiB+5vbH30okV

Malware Config

Targets

    • Target

      490a74783ce10188e11464a95262df27a825bf9804b63c47d84a0481225dcd0a

    • Size

      4.8MB

    • MD5

      c77c9ce1b1c514926abd59c2fc7a421d

    • SHA1

      c995eff569ac277b7be43fb616d1c85ff36de490

    • SHA256

      490a74783ce10188e11464a95262df27a825bf9804b63c47d84a0481225dcd0a

    • SHA512

      8eac79e0d35dd1dbc159fc34fb0730d083938a9097158094584dbfdb044dd93b5efa42a09c5d68ad88f5b56075649fa5e86dcd3d6f2fda63c0766ad91120fa26

    • SSDEEP

      98304:mhM/RqaAe88aJA+FSb5Bff2BQC1jIskYoDEB8bHkE0Aqpz4NDnGQ6:B/URe8VJ9FSiB+5vbH30okV

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks