Extracted

• • Target

    79b5a0229adc138d63a611b4982b1c2dc1bc7ed459473bd2bdaa82db544318e1

  • Size

    4.6MB

  • MD5

    badf0e3994943ce24bda4ad1117ae0c3

  • SHA1

    4bfd57dbb6cab7fbcad0706bc18ef82964efc962

  • SHA256

    79b5a0229adc138d63a611b4982b1c2dc1bc7ed459473bd2bdaa82db544318e1

  • SHA512

    cf3cef7aea4eac91b8a15dc005b08cd824159a4c114a21c68447d20597bcc7909de0b5ea3c5fd8bd70d21fd2fd8cf02ca6810e201e31cea49b771bf5ff5139ab

  • SSDEEP

    98304:m/+KXm5zCadoNaUS5P4gMIk0ihjABYKa2eP+7KKlR:XKXOmadooj2gtk0ipABYKC49R

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2