Overview

overview

10

Static

static

3

d072eaf6f1...2b.exe

windows7-x64

10

d072eaf6f1...2b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b0e24b7244b9e95971df2253559bdb12.bin

  • Size

    3.8MB

  • Sample

    240802-dzt8jatcnn

  • MD5

    58d69b197d67acb5bcb1c095f0668763

  • SHA1

    8f36eb3f02be2f5e0d163a620f8d78a6ebbaf167

  • SHA256

    66a40c3a8d62251755af05ad75e3fb190eedec68665f48072dd22b44f687b8b6

  • SHA512

    3f646153b3eb16bb09edc5daaf79023d7728ad852e8a5e892c5f196c1dd5d9f4c5ebaea640d98439cbfe17ba2407b95d8ae83a6759395b796433f0206b96ce9f

  • SSDEEP

    98304:eDFalieQHFOFb+g8WMfx9XqdcrA7GH/H0LT2c8QBA7fOg:eDFaEeQ4b+dpx9WcruGfULTf8QBUfOg

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      d072eaf6f16761ed0abb1f73d5e79225fdae23824fb9ac618d12788346f4982b.exe

    • Size

      3.8MB

    • MD5

      b0e24b7244b9e95971df2253559bdb12

    • SHA1

      1ac4cb52206e8ccec4b35e4f81f5005daa11d347

    • SHA256

      d072eaf6f16761ed0abb1f73d5e79225fdae23824fb9ac618d12788346f4982b

    • SHA512

      74c2b382cec9efdb88a7749c028a7d40228859420127d7efda31b468f7282a5175d05d1082269304f38cee6371095489b5e1f5eab50ad90ec759790a3361f160

    • SSDEEP

      98304:NluzbsF83EGLZ7tvK+ZhIyu/SI0Hu0CYwKXAjQX6odP/3:CzAW0O7AOu/EHuuwKXNX6oZv

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks