General

  • Target

    4acdd868ef5a8c14cb4db46ea9245265.bin

  • Size

    4.6MB

  • Sample

    240802-ce1ddaygnj

  • MD5

    2f8bfe257760386b4bc36952d6fa1744

  • SHA1

    a0212f6019b934df865d7bbb6dac7d4e211f5495

  • SHA256

    e7618e2fef457d5ad8546836969db395bed4723d5ce853a6f53d7bbaae4269bc

  • SHA512

    3c4bca1e04f4709bdc70cafa3f4567bb255ea05903e012348779a7b23e0d0de1db858b5173b795d8f51c6a0261f19b76c6eef9e8a4f23182f5fdf7dbd496a688

  • SSDEEP

    98304:jH7XH1YET0Unca32JFuKAJdzwFKD7hXWj0+U12SS4JTvK+86gUatm1Q:P1YEAUncQ2TyCw9XWYj12kJIrUaU1Q

Malware Config

Targets

    • Target

      ca4acdc7f7e2c2c2af54e94bdddb4ce94978c1e3c3fd3410ce6ca8e5aee827d0.exe

    • Size

      4.6MB

    • MD5

      4acdd868ef5a8c14cb4db46ea9245265

    • SHA1

      a1216fa64165792df1f5d714ee6840cd9502fee4

    • SHA256

      ca4acdc7f7e2c2c2af54e94bdddb4ce94978c1e3c3fd3410ce6ca8e5aee827d0

    • SHA512

      69106c32c30fe01b1e5fe436941de7ca2f391a117a617318c8e6557209715bb3c85c5334cadde059876ab10c2346714f206342dcf6d94e80abb0513fda0993c8

    • SSDEEP

      98304:C2OJW2Zvl0jcLMFw4cscyMZDtELsFxWWkQhnKzv9Fl:MqgQFMs5MHEgFxWHMncHl

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks