Extracted

• • Target

    2e5fc69b5e509351e5fab26819124385.exe

  • Size

    4.8MB

  • MD5

    2e5fc69b5e509351e5fab26819124385

  • SHA1

    7ec21ee1ed9b76690a1376cead4f6277d31aa3f7

  • SHA256

    5513ae93920fa055815a4d2c8e1559cf7c88fc352dbcde084ca666285beb101d

  • SHA512

    3dd90880283c7ffd7bb83b721f15bdd146711feab4c03acaf0678aa0d20c2efa86fb7d0bf585b1b9a1a9e217b39cc992f91562e726671c1e45eac907da447923

  • SSDEEP

    98304:mQZcNl5ewg+OOdoMLSmhtqodzKi1hm2YdjztF7W4Ipw:PyUwXAmesEzb6pw

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2