Extracted

• • Target

    6c018d0bfe3f19ca33049209757f339009ee53b3ac85544ab6e4e910e4b9d7c3

  • Size

    4.7MB

  • MD5

    5db362746c1c34c46dc6a0f2a36a59d0

  • SHA1

    edc8b09883f157cdad8c56bb55b175604b8cb3ef

  • SHA256

    6c018d0bfe3f19ca33049209757f339009ee53b3ac85544ab6e4e910e4b9d7c3

  • SHA512

    a4ed8de9dd07f299fbd748f37240a7f0e73e5ec2cce47d27a8a9135469c552ce5d6f401c42e9311ff619e69a83b2f9837f7d5609aa7236239a04bf3e4cbfa0d6

  • SSDEEP

    98304:mZhBg2fDEq3uvXiEh2fWERdI1NAPkC3zoPGQaPn:EhBNEWpeE01NAPkmoOH/

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2