General

  • Target

    def10a94a0f8c3628f3a506c4ee7b397.bin

  • Size

    3.8MB

  • Sample

    240802-d7ykxstgmj

  • MD5

    be5a9b34ca76b411fac2eaf5e8a351ef

  • SHA1

    7742e339e78b5beed5e515a2be2bda9f7012327c

  • SHA256

    7a1fd31727b3f69ea9d71bbafdd1e297514bf1b85862c6136ebe7a99f7d310bb

  • SHA512

    482f77fa951a6aea816b3c8454a5c04e7738a6ff807ef344a2a06b4a9640633eb94abebb3be8b6508fde7911219cdcbe546a005831adbd4fb5c2b335b99d3c61

  • SSDEEP

    98304:Hh6ezerpm1qdh2Tx9jrvuuEQT9DJfcv+Vrpw7Kj:HYezerpfkvlEQZNnSC

Malware Config

Targets

    • Target

      c131cb51cf9ad72483df8504488433a085302cdbb10d4d5e1d89bbdb748bb12a.exe

    • Size

      3.8MB

    • MD5

      def10a94a0f8c3628f3a506c4ee7b397

    • SHA1

      14206fe90c51756b347d94fd21fffb07dbc1338a

    • SHA256

      c131cb51cf9ad72483df8504488433a085302cdbb10d4d5e1d89bbdb748bb12a

    • SHA512

      563a110d0ca847738f558ea136168e91e8356ded4eefa2d2c0687f5105c40eac3ac4c2d5afc31bfba092e852cf69266a226fa32386768d823bb8f04c50d94c5a

    • SSDEEP

      98304:NZFIpY5VbjNXZrbN4u7XJMkxVxjOpGmSPXde9dF9:duMbrb2uhxjQGmSPXw939

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks