Extracted

• • Target

    cf0406c94eb49de3a98cb0b0f8f27ca897384598182eeb2130dbd81d58b70a05

  • Size

    4.9MB

  • MD5

    8c1dc2876a6674226522823b68984b78

  • SHA1

    a42cddc4f44a5c58c80ea9c8c6312a7af2b0524a

  • SHA256

    cf0406c94eb49de3a98cb0b0f8f27ca897384598182eeb2130dbd81d58b70a05

  • SHA512

    9117af9ddaba677d1f6c504804f43a06035e1787577fc2ebe8ea2889d981b58a3e6303eaeb76834e69bf5de16e040e1fc3229297e29fea378445342d5752c00a

  • SSDEEP

    98304:mv7goBoFMTdPcirR0PalZZlp9ebALVuB4tp5d2yJ4pf3B+E04ysM+PXrDC:kVdPcirR0ypgb2uc5YP+54LrW

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2