Extracted

• • Target

    f7fde436ceceabfaa6bfda5572030e730bf0912c215664af9b9fda62e5e08b6c

  • Size

    4.9MB

  • MD5

    a31fdf27cfd3d8057db491e55696b7c3

  • SHA1

    aeff4eca924c6b0dc2091e4d2d4e08b73187f7de

  • SHA256

    f7fde436ceceabfaa6bfda5572030e730bf0912c215664af9b9fda62e5e08b6c

  • SHA512

    ac00c3ac501dc00d03dc383d07b352058b588ffeb4e43131361bbbe6f729122729830fae928124928bf59168adbdbfc0d652bc38afb5ebeec06759ee84a4ce0c

  • SSDEEP

    98304:mSwGM3Z/u93SEQiH5SNfRAHaChnqG5rGDkQ3sABLLhtNAeGIOZ1:nwGABul37ZSBR2alorsbLLhtKxF

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2