Extracted

• • Target

    380d33122267e606830bba85597bbb9c.exe

  • Size

    4.8MB

  • MD5

    380d33122267e606830bba85597bbb9c

  • SHA1

    3c280b31f6be9b2a0d15f1cf0d932f314bbb724f

  • SHA256

    b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f

  • SHA512

    b7fa933a545da21541a38d5a14c376710cf792e222ebe4ab751d5090eb42f0ca4bf6dc90f943a67525c02d2684fdc9c8a973df46ca78204fe0d7ce47719053c1

  • SSDEEP

    98304:m1vNssAFCK0nMd3lhQ0UOaHc27PivQ5HOwRTtLrh4D9q1SKJetbNolkcZU:jsm93lhgOekM/Bt3o99tbO/ZU

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2