Extracted

• • Target
    5927ff34247cc44f8109948a52e943b8f7877e766182113da9cc80e32f5df290.exe
  • Size 4.7MB
  • SHA256 5927ff34247cc44f8109948a52e943b8f7877e766182113da9cc80e32f5df290
  • MD5 d7f9df0fff2167cda92ed63a544e13db
  • SHA1 ae536c59ae642d9f2cf9a9b5704ceb6dcac9a365
  • SHA512 41f4821a15411350062489f5388e6bee315ed51119bad9b906d82eee2337b5cd756ac9cad742d2e05df8bb3198aa49618a063ea99a0d585f656e83624498f55a
  • SSDEEP 98304:mZQUKNVuBildaX0+23FBtPN3ACRPJtxQkZe1nYNbmgtJHZEd45N6Lx:TUKGBTERVPN3NRPVQkZGnYNad45E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2