General

  • Target

    0b4c8d5b4c4506c0c43d974ca5ccb59942db38a629342e650d7e3f89d1ea9dca

  • Size

    3.9MB

  • Sample

    240802-q7wgsaxcnq

  • MD5

    4205a5ee0fe64320465bc614e61cbc47

  • SHA1

    576ad1914f3faed1990058c3e36260a2c952871e

  • SHA256

    0b4c8d5b4c4506c0c43d974ca5ccb59942db38a629342e650d7e3f89d1ea9dca

  • SHA512

    5a6af616255e92b86a7d86421cdcadb09b80840442b34e2932961742f8258815a4f2274d7e940f6f6d7397eb0a0b6dd16b49b291fb52a67a4cd858aa4d590a8e

  • SSDEEP

    98304:NFCS06WwrhQyLEhHWH/jUqD1pU/e5YJdpLxgzrd4:zfdWwHExkjUK1+/skpFmW

Malware Config

Targets

    • Target

      0b4c8d5b4c4506c0c43d974ca5ccb59942db38a629342e650d7e3f89d1ea9dca

    • Size

      3.9MB

    • MD5

      4205a5ee0fe64320465bc614e61cbc47

    • SHA1

      576ad1914f3faed1990058c3e36260a2c952871e

    • SHA256

      0b4c8d5b4c4506c0c43d974ca5ccb59942db38a629342e650d7e3f89d1ea9dca

    • SHA512

      5a6af616255e92b86a7d86421cdcadb09b80840442b34e2932961742f8258815a4f2274d7e940f6f6d7397eb0a0b6dd16b49b291fb52a67a4cd858aa4d590a8e

    • SSDEEP

      98304:NFCS06WwrhQyLEhHWH/jUqD1pU/e5YJdpLxgzrd4:zfdWwHExkjUK1+/skpFmW

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks