Extracted

• • Target

    c827093672a316522f1f5754b290bbd8b869ddfd71e2ca01ddad7533962e7095

  • Size

    5.0MB

  • MD5

    69392c54eba42a4bce4492cfd8d7a936

  • SHA1

    0cdaaf716111af270aac3c267ebc57b1ffd0a9a7

  • SHA256

    c827093672a316522f1f5754b290bbd8b869ddfd71e2ca01ddad7533962e7095

  • SHA512

    64a196ab342ef8cbd2281cdea34324e76a514c55e829971e05573632610b4fe3458ead46dca018a656af2f089e822134dcd805aaec147da6509726c63b9cb8a8

  • SSDEEP

    98304:mb1Wa27HSSp3ifx7VKcpnRA5FMFObLwVFtPVJbXsk:c1W7TF3ifLJnEFPwP18k

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2