Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8bb83116cc9da14c1884a63b8fabb84bf20001d7e23fca955b4c33925ddb7ad8

  • Size

    5.0MB

  • Sample

    240722-fs1svazglp

  • MD5

    2115b7844302181f7b848b77a3de7def

  • SHA1

    671d9a9d4bce2c4a7b864f57bbb132e1eed7eb9f

  • SHA256

    8bb83116cc9da14c1884a63b8fabb84bf20001d7e23fca955b4c33925ddb7ad8

  • SHA512

    17f3529dcec9122a824ee54bab0d95c5504000e22169f4c0db742646a075902f32d2629ca18968215d38f16aff5e48f1c5e74a6eada12c51142c77916a57d7ca

  • SSDEEP

    98304:CHUiJRy/n97DW9Hb+LXGWv0kCnoOXsIUtdodgfbDCEFww7Ae+zeqgQBjnqyQxB:8U6RgS+bG3kW8IUAGfRFD7tzqx9fQH

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      8bb83116cc9da14c1884a63b8fabb84bf20001d7e23fca955b4c33925ddb7ad8

    • Size

      5.0MB

    • MD5

      2115b7844302181f7b848b77a3de7def

    • SHA1

      671d9a9d4bce2c4a7b864f57bbb132e1eed7eb9f

    • SHA256

      8bb83116cc9da14c1884a63b8fabb84bf20001d7e23fca955b4c33925ddb7ad8

    • SHA512

      17f3529dcec9122a824ee54bab0d95c5504000e22169f4c0db742646a075902f32d2629ca18968215d38f16aff5e48f1c5e74a6eada12c51142c77916a57d7ca

    • SSDEEP

      98304:CHUiJRy/n97DW9Hb+LXGWv0kCnoOXsIUtdodgfbDCEFww7Ae+zeqgQBjnqyQxB:8U6RgS+bG3kW8IUAGfRFD7tzqx9fQH

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks