Extracted

• • Target
    025d0d86a0f636647681f95d1b9db3067fc854b81925915680118ae586b80cf0.exe
  • Size 4.8MB
  • SHA256 025d0d86a0f636647681f95d1b9db3067fc854b81925915680118ae586b80cf0
  • MD5 321e35385a1910a07011008666e9b09c
  • SHA1 a2c4513e719772bf504346539767c389c2646648
  • SHA512 a3dd5652c0034f2005ecaaa14b588de505ec06f55c6301c45eec924b3ac8b57679f920244c5dc1376b5ad0556e6fa1a85d11530e7b3af122caf33293a3631943
  • SSDEEP 98304:msGd+gmDfOctl2hqfJ6pIXM8RdIBY+zssvh07FJ2yNhlzvuFx:zGVmCA2oQGc8R+BYS67FsyNhi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2