Extracted

• • Target

    dfd041760181f5d29dd830b83973f390068ff7ce530d6a771b010a47ad195c44

  • Size

    4.6MB

  • MD5

    4980cab179979a213209674aaa5c9a98

  • SHA1

    039a4dd371beac2e623794842f6f58aec2e37922

  • SHA256

    dfd041760181f5d29dd830b83973f390068ff7ce530d6a771b010a47ad195c44

  • SHA512

    d5540d6d3086d6d07093d35f0c71ef7d5802f5ba677adfc2cdf7c431de38ad973e2ea8be7d2bfa03d32a3e6232a079ef52ff6a0b634b342ef9367efcb01ba0b7

  • SSDEEP

    98304:mNXsTFjk3quUOMaIg8lwvgYiiEL4nvG2HGhWrr6MgRi0r0mkHwccqE:qXsTFIaupMlw4YB/vG2mhGrZaxjDz

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2