General
-
Target
2ff65ecc86dec9b53e7fe165737becb25f3b48dd6472e330c922fce56a03f628
-
Size
5.0MB
-
Sample
240619-q4sayswdmr
-
MD5
eb65b164d408a047ffd950aeb125747e
-
SHA1
2d84c0743a9750ac16bf0386d97f335efcb46e7e
-
SHA256
2ff65ecc86dec9b53e7fe165737becb25f3b48dd6472e330c922fce56a03f628
-
SHA512
94c32fec631687ee071a1be5c80ac9e1212cbcef7bf9ba42c637fd3fd6ea61c2c3206221eb45175001e52aadce0d81eafa94ab00179a7eb6b4055f006b9ca089
-
SSDEEP
98304:mMqgT95izOxlUMVV+6Cuk9/APo1+K26cE1KrVxxX1ypAWakf:XqKGzOPUMVcTH9/gq26c9/JgWWakf
Malware Config
Extracted
socks5systemz
bgivegi.com
http://bgivegi.com/search/?q=67e28dd86e09a721465dff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978f771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff719c0ea95983b
ebvduoh.ua
http://ebvduoh.ua/search/?q=67e28dd83f0fa67d125ca51e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978f371ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff719c0ea959b32
Targets
-
-
Target
2ff65ecc86dec9b53e7fe165737becb25f3b48dd6472e330c922fce56a03f628
-
Size
5.0MB
-
MD5
eb65b164d408a047ffd950aeb125747e
-
SHA1
2d84c0743a9750ac16bf0386d97f335efcb46e7e
-
SHA256
2ff65ecc86dec9b53e7fe165737becb25f3b48dd6472e330c922fce56a03f628
-
SHA512
94c32fec631687ee071a1be5c80ac9e1212cbcef7bf9ba42c637fd3fd6ea61c2c3206221eb45175001e52aadce0d81eafa94ab00179a7eb6b4055f006b9ca089
-
SSDEEP
98304:mMqgT95izOxlUMVV+6Cuk9/APo1+K26cE1KrVxxX1ypAWakf:XqKGzOPUMVcTH9/gq26c9/JgWWakf
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-