Extracted

• • Target

    d787f9aa7215933a6c4edd8fd967fe9271621aa25f0ca91d1b122951ba2eeac9.exe

  • Size

    4.6MB

  • MD5

    163f02daccafc821121536bd93f8ef29

  • SHA1

    606048453e0954e969ccd69d08edd57c3fb961fb

  • SHA256

    d787f9aa7215933a6c4edd8fd967fe9271621aa25f0ca91d1b122951ba2eeac9

  • SHA512

    ce971cadfeab1c5dee9a0b1e6cf3d013f47bcf795f9f870cf1c23346a24a8950cc777a6ff448168386086a5ac230420a27b824b5f45a0fd54282e9e85dce2cf3

  • SSDEEP

    98304:mU+RUid5xVQCMpF5T8LRA8VbQtcf1wLryv8Ln3vKVrHrQ:V+RUid5TQCMX549JQmWLryv8LMrLQ

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Detects executables packed with VMProtect.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2