General
-
Target
c255c4a2900ea20891830e2bce25eebd270672ba0d8776ee3f30f747f0b1adce
-
Size
5.0MB
-
Sample
240617-fts5dszdqp
-
MD5
9db36d4886fa401c665ab2f52ad53160
-
SHA1
be476b938592aa9126be10daf152212b6a48c72e
-
SHA256
c255c4a2900ea20891830e2bce25eebd270672ba0d8776ee3f30f747f0b1adce
-
SHA512
d50612507e71c2a06ac1df3122fe4f7dfbd2d18ae6bafb53416dca4042b8449e6260a1df1600a02ac65281bb1738864d47b58ac45aa47b29423eda215c47ce50
-
SSDEEP
98304:msDxfraUAOxPh1oDRtadtXYUkhMV0Ck8CoMv1amCUiUsZtwFrquq7:bZum3oEYUkhMVHM57CJFCFmue
Malware Config
Extracted
socks5systemz
aquoieb.ru
http://aquoieb.ru/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f88ff10c0e793
aiascer.ru
http://aiascer.ru/search/?q=67e28dd8645fa72f495daa1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff717c0ee959238
Targets
-
-
Target
c255c4a2900ea20891830e2bce25eebd270672ba0d8776ee3f30f747f0b1adce
-
Size
5.0MB
-
MD5
9db36d4886fa401c665ab2f52ad53160
-
SHA1
be476b938592aa9126be10daf152212b6a48c72e
-
SHA256
c255c4a2900ea20891830e2bce25eebd270672ba0d8776ee3f30f747f0b1adce
-
SHA512
d50612507e71c2a06ac1df3122fe4f7dfbd2d18ae6bafb53416dca4042b8449e6260a1df1600a02ac65281bb1738864d47b58ac45aa47b29423eda215c47ce50
-
SSDEEP
98304:msDxfraUAOxPh1oDRtadtXYUkhMV0Ck8CoMv1amCUiUsZtwFrquq7:bZum3oEYUkhMVHM57CJFCFmue
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-