Extracted

• • Target

    390fb138f1c89f85d558e5bef92275b2aeda2211d9ce8f6f2bbd009ddcacf345

  • Size

    4.6MB

  • MD5

    ca39bd40beb013b70bc8e68bc13b6b88

  • SHA1

    d6116b23d974ed79b431cb559dde21c2da6197f2

  • SHA256

    390fb138f1c89f85d558e5bef92275b2aeda2211d9ce8f6f2bbd009ddcacf345

  • SHA512

    41c845164b2cb2588e56932819d38ea840e1f1ae85af79ebef8e32871660cc6c731db346c12dde73b0c785fc7b62b4aabef5e75c1c5d594b96d8e943c14fd139

  • SSDEEP

    98304:m7ZxpbjUAnvXnZxuhvi99WEFsNe2o4HZ8UJ:0ZxpL/ZwhvMy2KZ8UJ

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2