Extracted

• • Target

    8655afc60d0845930de53ffdb87c25cfc600c097039bbb7dd1cdaa713b85d172

  • Size

    4.5MB

  • MD5

    bdf942b5db3400fcd080e65c010da2eb

  • SHA1

    4602389c8ce2946d4995d3f8870487d36273017b

  • SHA256

    8655afc60d0845930de53ffdb87c25cfc600c097039bbb7dd1cdaa713b85d172

  • SHA512

    d521f0dc0a7631f8631d34b7a66390897a3dfe0e6a5217d7a75fc3b7515131b215b495fc90b2585ba92a6b7051a473a0e1f135bf73191cf7ffd4dcb4ab28c0c0

  • SSDEEP

    98304:mn9nw0s0pmpQNds2Ra/u6ZWR/8pXDLJEd2UW18dh27fB65:Yw0spO6X26ZA8pXDGk18d/5

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2