General
-
Target
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693
-
Size
4.6MB
-
Sample
240613-3v64zawdpf
-
MD5
4173debbc3d407dca3905c212ab537f2
-
SHA1
807cd0f7e7337545ecde2a1dec4fd9ad6b31ad7a
-
SHA256
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693
-
SHA512
884581348592d891c95e916481d5e2b2fe1aeef7fd55b25acf2010bf542c7f3e6f15e7be6ec1f2813e9a4dc0cbc853c9c0beca2c13b0d6bc5d1e8a2a6827d57d
-
SSDEEP
98304:mTMDgLaCF/V6GoPhbZQ0sdYJi4LXyrk/BAqZ0pyrXFtbrKeDYSLdCu9zlp:kMDEaG/V6PPhb5sGJDLCrkCXSFlrKUYy
Malware Config
Extracted
socks5systemz
bwdfprf.com
itaddss.info
cstpazq.net
http://cstpazq.net/search/?q=67e28dd8655bf57a4609f84c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff712c2ed92993f
http://cstpazq.net/search/?q=67e28dd8655bf57a4609f84c7c27d78406abdd88be4b12eab517aa5c96bd86e99d8e4f855a8bbc896c58e713bc90c91d36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee9d9939cf689512
Targets
-
-
Target
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693
-
Size
4.6MB
-
MD5
4173debbc3d407dca3905c212ab537f2
-
SHA1
807cd0f7e7337545ecde2a1dec4fd9ad6b31ad7a
-
SHA256
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693
-
SHA512
884581348592d891c95e916481d5e2b2fe1aeef7fd55b25acf2010bf542c7f3e6f15e7be6ec1f2813e9a4dc0cbc853c9c0beca2c13b0d6bc5d1e8a2a6827d57d
-
SSDEEP
98304:mTMDgLaCF/V6GoPhbZQ0sdYJi4LXyrk/BAqZ0pyrXFtbrKeDYSLdCu9zlp:kMDEaG/V6PPhb5sGJDLCrkCXSFlrKUYy
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-