Extracted

• • Target

    115cd73c234674adbcc04ebe6a5e39c2c2b0af9d8195ae9adc5203a2dbb15415

  • Size

    4.5MB

  • MD5

    7349b41ae1386ba41cbd2c527a791cc0

  • SHA1

    1bd1be063facd0b8e58c52a84cc1b9c283406f83

  • SHA256

    115cd73c234674adbcc04ebe6a5e39c2c2b0af9d8195ae9adc5203a2dbb15415

  • SHA512

    81ee53b8b321ee68a2f7293bd548aa1285c63aaddf2adfec77a38593e1f4e6a22a5055f7b96cacf5a253ff9a207023862b2e61c6ceb87c85505f17ea4c7b90c8

  • SSDEEP

    98304:mkIVgsXFyGsYKO3ujhvUChaMZY00TL5XXMGFGg/a7:tygsXFyx3ku9cg03ZMOS

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2