General

  • Target

    c41b55f30bbfd195e70190415c242f224fc2257e19a8b66fd3e03485f9f4572c

  • Size

    4.8MB

  • Sample

    240530-m8zdaafb7z

  • MD5

    ccaabc1da8b300711446793ca2df28b7

  • SHA1

    e1f4b0715b5a73225a97ad0d96210127dbafe188

  • SHA256

    c41b55f30bbfd195e70190415c242f224fc2257e19a8b66fd3e03485f9f4572c

  • SHA512

    d48f2b7d875607b8f12ebaf797f06bbc0ee0df3108548312a9cb640af6641a7afd2af92b06459016f29920f57af1597f33e0811fa4b7fde39c30bd339f402262

  • SSDEEP

    98304:m2HXWTA6+amdZofSbfYqez+L+RUYsWu1+8IfUxfQh+v2:v3eFi+S+dfe6l

Malware Config

Targets

    • Target

      c41b55f30bbfd195e70190415c242f224fc2257e19a8b66fd3e03485f9f4572c

    • Size

      4.8MB

    • MD5

      ccaabc1da8b300711446793ca2df28b7

    • SHA1

      e1f4b0715b5a73225a97ad0d96210127dbafe188

    • SHA256

      c41b55f30bbfd195e70190415c242f224fc2257e19a8b66fd3e03485f9f4572c

    • SHA512

      d48f2b7d875607b8f12ebaf797f06bbc0ee0df3108548312a9cb640af6641a7afd2af92b06459016f29920f57af1597f33e0811fa4b7fde39c30bd339f402262

    • SSDEEP

      98304:m2HXWTA6+amdZofSbfYqez+L+RUYsWu1+8IfUxfQh+v2:v3eFi+S+dfe6l

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks