Extracted

• • Target

    767ee235d983a205755b80df62065acf425b2c59f493ab281e3898c49fa5024f

  • Size

    4.8MB

  • MD5

    13def02a248a8f9a20fb3e90ba6fd562

  • SHA1

    0e8786a982967693f0a37955959c05ac21a4b853

  • SHA256

    767ee235d983a205755b80df62065acf425b2c59f493ab281e3898c49fa5024f

  • SHA512

    07f59a475d299772b0bed4efbbc34a50fd46637a937a3d944f2fa5d09844123b1f86c486dd5b154386e0fc4bef2d169468b7f9ddad7f5682812013d6f2ac9a93

  • SSDEEP

    98304:mrx2sTCX2PShrne5m3fFr4quUKr1IczAZumgCnjAtrax/8DIN6ll:4HTCNe5v3UKr1HU0mgCnEtyUscll

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2