Extracted

• • Target

    ab5dbd15bd7a36e1cd2e9cdfc1fc67850707ace6422df0e1764fb2e132afd674

  • Size

    4.9MB

  • MD5

    f1d0a7d080ec0bc84837e0a22effa03a

  • SHA1

    57b83532d806a8c40fb3eca4e134dd315e6b1edf

  • SHA256

    ab5dbd15bd7a36e1cd2e9cdfc1fc67850707ace6422df0e1764fb2e132afd674

  • SHA512

    38a34aba95fccc69c5dcb538a33cc3e52fb0cb4e813080b9b31a4eb667f12fe69a4efd30f9cba253355e5413f63e3c8ecb97fb331471d3110b8a5a99b58bd75d

  • SSDEEP

    98304:meTMh6Mm4HB8eQdMosede+YVCwBCr4DQH6ikoDLLoq7R6:jThvsBxe/sp+1MCr4ka0LLov

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2