Extracted

• • Target

    b29a0f30927b1674b4806be5184af9d2d911e219324e1ea61d7eb59a669fa320

  • Size

    4.7MB

  • MD5

    2b2f87d47527043dd62ee6ab8f4c039d

  • SHA1

    4f76faa9d7275034e25a5d613a14ee732dbc5aa3

  • SHA256

    b29a0f30927b1674b4806be5184af9d2d911e219324e1ea61d7eb59a669fa320

  • SHA512

    1e5796f07047c9c1e4fe0357984656220e03170b52fe52389a1d888769e6baef973fb1bcf8d9eea66e611a03c5744c32259b5fddb0fa6bfeff06fde2a6a6eb9e

  • SSDEEP

    98304:mUNlwAlssFGx6SrkLRoAPcoAdyYvGdezQpSeiJaniWKmSTx:vNlgiEkLOA09yiGg+diaiWFMx

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2