General

  • Target

    94e29e771625123beafa154316e8a9f6c1bbf80160cc6ef7b1c0ecad20a9b4ce

  • Size

    3.8MB

  • Sample

    240802-cq85nazfkj

  • MD5

    89c6a0eba836f8413210877348c456a8

  • SHA1

    d649c2a054f12976799d76ca2153bb3e60027524

  • SHA256

    94e29e771625123beafa154316e8a9f6c1bbf80160cc6ef7b1c0ecad20a9b4ce

  • SHA512

    3f950c77c75669199a0291bf92f8be1248900594cd514dab4fd87e240727b1b006aae10ef02c3e6c2a94ef42d7a2699cb4a2019f19ee451aa3a6bafda672925f

  • SSDEEP

    98304:Nv3WGa6jHIM4CAPDy9JLDs7SF07OgVwc1RsdRq7:N5/bkdy9tWSF6OgVFXs3q7

Malware Config

Targets

    • Target

      94e29e771625123beafa154316e8a9f6c1bbf80160cc6ef7b1c0ecad20a9b4ce

    • Size

      3.8MB

    • MD5

      89c6a0eba836f8413210877348c456a8

    • SHA1

      d649c2a054f12976799d76ca2153bb3e60027524

    • SHA256

      94e29e771625123beafa154316e8a9f6c1bbf80160cc6ef7b1c0ecad20a9b4ce

    • SHA512

      3f950c77c75669199a0291bf92f8be1248900594cd514dab4fd87e240727b1b006aae10ef02c3e6c2a94ef42d7a2699cb4a2019f19ee451aa3a6bafda672925f

    • SSDEEP

      98304:Nv3WGa6jHIM4CAPDy9JLDs7SF07OgVwc1RsdRq7:N5/bkdy9tWSF6OgVFXs3q7

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks