General
-
Target
dd17f874ceb2b4a7f755e42419f9e72c45063a4f4ba13c1209e32a342fd86d39
-
Size
5.0MB
-
Sample
240613-gvlblsxajc
-
MD5
fc305092defe1f2e2c1b3cd9e99c4860
-
SHA1
d3e4c502bef44d6ae0caeb44b903baff34c453b6
-
SHA256
dd17f874ceb2b4a7f755e42419f9e72c45063a4f4ba13c1209e32a342fd86d39
-
SHA512
65f9294bfb42b10cbfa9be1f68e09a31fb4dbc29937a9b327e59c375f9123856a318ca9db7d9b00388fe0752434014b1db84b2d588df5f35bcbf09ae18a49f2f
-
SSDEEP
98304:mImXN+SJO6lnQlIPWsMt0g+Ocyrvh1VhDmP6Aowv7twhDtZqhHpm1ZIvBHO9doM8:m9+SJO6lnQlIPWsRODrJ1V4vlmXqhpce
Malware Config
Extracted
socks5systemz
bnhclth.com
http://bnhclth.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c5e79c9b32
http://bnhclth.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12eab517aa5c96bd86e890834e96148ab2865b77f80ebad9c20f7cb63037ed2ab423a4314383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1e7979f33c46e9f
boxiuhi.com
Targets
-
-
Target
dd17f874ceb2b4a7f755e42419f9e72c45063a4f4ba13c1209e32a342fd86d39
-
Size
5.0MB
-
MD5
fc305092defe1f2e2c1b3cd9e99c4860
-
SHA1
d3e4c502bef44d6ae0caeb44b903baff34c453b6
-
SHA256
dd17f874ceb2b4a7f755e42419f9e72c45063a4f4ba13c1209e32a342fd86d39
-
SHA512
65f9294bfb42b10cbfa9be1f68e09a31fb4dbc29937a9b327e59c375f9123856a318ca9db7d9b00388fe0752434014b1db84b2d588df5f35bcbf09ae18a49f2f
-
SSDEEP
98304:mImXN+SJO6lnQlIPWsMt0g+Ocyrvh1VhDmP6Aowv7twhDtZqhHpm1ZIvBHO9doM8:m9+SJO6lnQlIPWsRODrJ1V4vlmXqhpce
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-