Extracted

• • Target

    efdde3de766dc42d8474f9202fe7f7afe5bca4d0e0a4562ca8fd1a5aa1fc944d

  • Size

    4.5MB

  • MD5

    b64b3050b57029846afbab4b5662a9bc

  • SHA1

    471be048fbd996f1cc56267e28c7e15b5b77e80c

  • SHA256

    efdde3de766dc42d8474f9202fe7f7afe5bca4d0e0a4562ca8fd1a5aa1fc944d

  • SHA512

    18ce5e4932721bef4a18b56b4878aaf98d180030f3795c0653ba15f32dc090a027d4b0e7b20ebba44ec2aeca1947b39d3a1d0f1df774df77e2723f8361a1f063

  • SSDEEP

    98304:m6dwQCayJ0tFitrlVJ6DF0vw89+w5V6aXEAQyeObtRW4ZuUkH:Be23CJ6Dyvwwz5CAQyD8TUo

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2