General
-
Target
38eef33cea1306be6f7cd291886e46d49a2dc716a989721920cd5575ab88d23a
-
Size
4.7MB
-
Sample
240613-2n4vlatdke
-
MD5
57e1ef6e4594f05cd796583d58a49b5d
-
SHA1
6054e2e48eb6bfe5d28440e9fbd8da2d75137d45
-
SHA256
38eef33cea1306be6f7cd291886e46d49a2dc716a989721920cd5575ab88d23a
-
SHA512
69fc7ac32845f87c1687ed2db11cedaca39501048746b32e000e639ea32ebe67fcda48bbd4db55a39695c7d194b227745b3ba0e1ee92f7096904e5b829108584
-
SSDEEP
98304:mg6mvgxVO0cdG07L9nEUuVV8Nx/s8idMzSG9ycjO6ipC6:l1vg3O0NeEJVIW8idaTO6y
Malware Config
Extracted
socks5systemz
dtiiuyb.info
jeguhel.info
bukkkjp.com
http://bukkkjp.com/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff712c1e7929e3a
fiuhebo.ru
http://fiuhebo.ru/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff712c1e7929e3a
Targets
-
-
Target
38eef33cea1306be6f7cd291886e46d49a2dc716a989721920cd5575ab88d23a
-
Size
4.7MB
-
MD5
57e1ef6e4594f05cd796583d58a49b5d
-
SHA1
6054e2e48eb6bfe5d28440e9fbd8da2d75137d45
-
SHA256
38eef33cea1306be6f7cd291886e46d49a2dc716a989721920cd5575ab88d23a
-
SHA512
69fc7ac32845f87c1687ed2db11cedaca39501048746b32e000e639ea32ebe67fcda48bbd4db55a39695c7d194b227745b3ba0e1ee92f7096904e5b829108584
-
SSDEEP
98304:mg6mvgxVO0cdG07L9nEUuVV8Nx/s8idMzSG9ycjO6ipC6:l1vg3O0NeEJVIW8idaTO6y
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-