Extracted

• • Target

    c4e786064636ee2d18853922e009f8eeb953057f3e78fde676f96e03a0df7521

  • Size

    4.6MB

  • MD5

    5f0f4931aa863ecffc5a8d3528651803

  • SHA1

    0c6348ae759dbde0810315d88045c14b20ec437d

  • SHA256

    c4e786064636ee2d18853922e009f8eeb953057f3e78fde676f96e03a0df7521

  • SHA512

    041a284b4aa9d67a8871353bb135513e14e3752b616af3bde59051f65526a3c77f030bca2ca1d44d1a8904996cb4c2462d5a6a08009cf0f798b31b659c3ed19e

  • SSDEEP

    98304:mBC1ikeSt91ispFtFph4XT9SeAMwYenrYOQj6rP6cL6nJyg:okeSND/ph4XBSeAC4SjSP6E6nJn

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2