Extracted

• • Target

    8f15a74d7a1f5aaf404711e6b10ab08a43d5d766817833dc9a62651b287b0a0d

  • Size

    4.9MB

  • MD5

    0f05aec0b71fe5af94e716a168b936b5

  • SHA1

    e1f00aaf1dc8ea7c50243aee2c7e41fb0d31180a

  • SHA256

    8f15a74d7a1f5aaf404711e6b10ab08a43d5d766817833dc9a62651b287b0a0d

  • SHA512

    9cd2bc9bed15de9b952e90b0746b8dc73ccb03b9689c55d4a54cac46423b443348eb4cacff362099cd6d8c20f1d213a96bd42163541c85cf009116c49399bc17

  • SSDEEP

    98304:mrqpaDd+PinS9UHTLYlGSU1mwXeYEiFFZhZBkz:XSNS9UHHYlum3YtFF9Bkz

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2