Extracted

• • Target

    dd2eb3b56c3ab349eb4a4e8f2e958680e2cb7697b4581642f0be0f2459dedb61

  • Size

    4.5MB

  • MD5

    c45d72f989f0ec926c855ce135896c48

  • SHA1

    90c16a7446ec5bc196dfe74f340588ccfb916e9b

  • SHA256

    dd2eb3b56c3ab349eb4a4e8f2e958680e2cb7697b4581642f0be0f2459dedb61

  • SHA512

    ce19b94f57c8bd985d0bb97e7775fa30679659a922ee26a648f0219d36c158ebe57cb3aa027637aa7fefa239187acc591743ec94ba0e3cc53d22d359f39304c9

  • SSDEEP

    98304:mxCS32PlqvA85StGZ/we+eImAe8CdvBTXGdON3S+GUAjCQ7hh:qCi2PltCZ/w4aCdvpyx2yn

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2