Extracted

• • Target

    fb6afe9736f88c71b7e9ff95884ff9f67a4a7dbac8e81f9431cd610511e19622

  • Size

    4.8MB

  • MD5

    8dc717ec04865a086480b1be0fde0d72

  • SHA1

    379f1fa44b8b4301f3254501850c6dfd86f96147

  • SHA256

    fb6afe9736f88c71b7e9ff95884ff9f67a4a7dbac8e81f9431cd610511e19622

  • SHA512

    f2f18fc4e8433221dbf3d0e22e237b787bfad2b458625213bbacb0d8eb78477bc0f04e0a697b92a56d605b0139bb1802cdaf2d804de1ad701b582eacb67e86ef

  • SSDEEP

    98304:mdYhyAOCSNcxiizt2RreYW2aVCCQQCJjZ1h23ll:cYXFk892vaQKuZPwll

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2