General
-
Target
380d33122267e606830bba85597bbb9c.exe
-
Size
4.8MB
-
Sample
240613-lvgqmstdld
-
MD5
380d33122267e606830bba85597bbb9c
-
SHA1
3c280b31f6be9b2a0d15f1cf0d932f314bbb724f
-
SHA256
b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f
-
SHA512
b7fa933a545da21541a38d5a14c376710cf792e222ebe4ab751d5090eb42f0ca4bf6dc90f943a67525c02d2684fdc9c8a973df46ca78204fe0d7ce47719053c1
-
SSDEEP
98304:m1vNssAFCK0nMd3lhQ0UOaHc27PivQ5HOwRTtLrh4D9q1SKJetbNolkcZU:jsm93lhgOekM/Bt3o99tbO/ZU
Malware Config
Extracted
socks5systemz
aavebxf.ru
http://aavebxf.ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cf813c3ec94
http://aavebxf.ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12eab517aa5c96bd86e5908f4e96148ab2865b77f80ebad9c10f7cb63037ed2ab423a43b4383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe19c2e8979938cc
bhuqpyx.com
Targets
-
-
Target
380d33122267e606830bba85597bbb9c.exe
-
Size
4.8MB
-
MD5
380d33122267e606830bba85597bbb9c
-
SHA1
3c280b31f6be9b2a0d15f1cf0d932f314bbb724f
-
SHA256
b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f
-
SHA512
b7fa933a545da21541a38d5a14c376710cf792e222ebe4ab751d5090eb42f0ca4bf6dc90f943a67525c02d2684fdc9c8a973df46ca78204fe0d7ce47719053c1
-
SSDEEP
98304:m1vNssAFCK0nMd3lhQ0UOaHc27PivQ5HOwRTtLrh4D9q1SKJetbNolkcZU:jsm93lhgOekM/Bt3o99tbO/ZU
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-