General
-
Target
753ea801ae752661103a6dc26db54185f6bf7294cd7957343583f0377cae47a1
-
Size
4.6MB
-
Sample
240613-3dd2vsyepl
-
MD5
6d37dfd43fe60ea1ec709e38e11c93de
-
SHA1
aa535a2b2858e9991b6dddd391254b78fb654c88
-
SHA256
753ea801ae752661103a6dc26db54185f6bf7294cd7957343583f0377cae47a1
-
SHA512
66c50bc47e62d6066ab0519bb9890ab23f9fa1cd57f57a61aee124349d6548400815a7f341ceea4d70c3442e1cccf270f026a817a42d50f1c37933b6a05bbec6
-
SSDEEP
98304:m625nEAey9Pe2a/Thwac4p6g98YevsugBrJdDUxj0WM/O2:HmEnMi7hwa9SmHCwG2
Malware Config
Extracted
socks5systemz
bnqbysv.com
http://bnqbysv.com/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dfd10c0e696
bfuggwp.com
http://bfuggwp.com/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff712c2ee959d32
Targets
-
-
Target
753ea801ae752661103a6dc26db54185f6bf7294cd7957343583f0377cae47a1
-
Size
4.6MB
-
MD5
6d37dfd43fe60ea1ec709e38e11c93de
-
SHA1
aa535a2b2858e9991b6dddd391254b78fb654c88
-
SHA256
753ea801ae752661103a6dc26db54185f6bf7294cd7957343583f0377cae47a1
-
SHA512
66c50bc47e62d6066ab0519bb9890ab23f9fa1cd57f57a61aee124349d6548400815a7f341ceea4d70c3442e1cccf270f026a817a42d50f1c37933b6a05bbec6
-
SSDEEP
98304:m625nEAey9Pe2a/Thwac4p6g98YevsugBrJdDUxj0WM/O2:HmEnMi7hwa9SmHCwG2
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-