Overview

overview

10

Static

static

3

7256e9f673...12.exe

windows7-x64

10

7256e9f673...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7256e9f673b78c62aae25f78902c393d758262202e8ab4e4b4f1d5d01cd4cd12.exe

  • Size

    4.7MB

  • Sample

    240612-xd3gkazapq

  • MD5

    fa367a7d44377d2c3f684c3912fec827

  • SHA1

    cb9e24a00431a7cccecf333b5d4ec34785389191

  • SHA256

    7256e9f673b78c62aae25f78902c393d758262202e8ab4e4b4f1d5d01cd4cd12

  • SHA512

    90edcd670a8b1354b7c016e8ea1980c768ecddb55de990261d1e88b3a524152a6710f72f79df5d7e4f791ae7c5f74aef7c0548f019613495309cc91ac4889ec5

  • SSDEEP

    98304:mijrTEGdwJoSZ3iYy6zAhDzjk9AuLS4HPaOMNRiYcMYO4:RPTEjl3IhLaAuL9iOERiYRYO4

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Extracted

Family

socks5systemz

C2

bxzbntz.com

ebsgoqi.ua

Targets

    • Target

      7256e9f673b78c62aae25f78902c393d758262202e8ab4e4b4f1d5d01cd4cd12.exe

    • Size

      4.7MB

    • MD5

      fa367a7d44377d2c3f684c3912fec827

    • SHA1

      cb9e24a00431a7cccecf333b5d4ec34785389191

    • SHA256

      7256e9f673b78c62aae25f78902c393d758262202e8ab4e4b4f1d5d01cd4cd12

    • SHA512

      90edcd670a8b1354b7c016e8ea1980c768ecddb55de990261d1e88b3a524152a6710f72f79df5d7e4f791ae7c5f74aef7c0548f019613495309cc91ac4889ec5

    • SSDEEP

      98304:mijrTEGdwJoSZ3iYy6zAhDzjk9AuLS4HPaOMNRiYcMYO4:RPTEjl3IhLaAuL9iOERiYRYO4

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks