Extracted

• • Target

    8915fa2fe448397dd3f75e32ab07939e8fab47f8aeef27bb258bb702d9813414

  • Size

    4.4MB

  • MD5

    ac929e82eec9484ca0db33dc610a078f

  • SHA1

    122e4a3010e4b26801bb508a10310595ed6529a5

  • SHA256

    8915fa2fe448397dd3f75e32ab07939e8fab47f8aeef27bb258bb702d9813414

  • SHA512

    818ba1cf72d6d7e9a58cf7575c7ff2a0eceb126353d45ad700442cced0f4f2766c05cac48f91bf96b75f9d2150d2a10c5f269f0dc7930f69a4468a1b3888ae4c

  • SSDEEP

    98304:mRUI7mMPnlSB447W280q5qhY9W4nPUuJNThuUBEMk/h:ACMPl044C280eqhKnTThgMGh

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2