Extracted

• • Target

    bf7fbe3502ef01e03f0fb5f81e472de4d73116f4be8f1a7d0818866522884c10

  • Size

    4.6MB

  • MD5

    85cc1c2094eb2a2b582e138466c9f7a5

  • SHA1

    465dbdb4fe4cd54178eb870658d064a1da1add5b

  • SHA256

    bf7fbe3502ef01e03f0fb5f81e472de4d73116f4be8f1a7d0818866522884c10

  • SHA512

    6c055688410ffc79bc1f73712be0fa2a216e3216123c0fce27017100f0a7ee615e558521ab0c78f9951a9883739b7b0d1fc1ae871fc2b6761ee8e3cbe523dfd6

  • SSDEEP

    98304:mLuvyGMPW8LFmQpHnKm3fRgrzA0KHovTVwKk:jvyGMPvPR3fRgrsLIvWh

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2