General

  • Target

    0b73b6a445183fb265e533d811bebf9285d4618166b01f7d8f63dcc51aa93f8a

  • Size

    3.8MB

  • Sample

    240803-eqdpvsxend

  • MD5

    191e14b3e7e5165989cf70fb472c5ecc

  • SHA1

    5f6f4415606e5e5225f9af195d85979d3800d152

  • SHA256

    0b73b6a445183fb265e533d811bebf9285d4618166b01f7d8f63dcc51aa93f8a

  • SHA512

    0b4a8b3728bbc666fb5077440b4da0cba09b235b6d8fd925ffcdf4b3e842b0aab6a911bee8a701c88ad1d2284f5b9ef5b499250863276b5203cab977c4c8f4b6

  • SSDEEP

    98304:Np2aqV1SQOv/u1ijP8vaiaD+hKFEutlW0z5uKWoXyl3dK:Ox/PORjEvF2WuSm5ooXyl34

Malware Config

Targets

    • Target

      0b73b6a445183fb265e533d811bebf9285d4618166b01f7d8f63dcc51aa93f8a

    • Size

      3.8MB

    • MD5

      191e14b3e7e5165989cf70fb472c5ecc

    • SHA1

      5f6f4415606e5e5225f9af195d85979d3800d152

    • SHA256

      0b73b6a445183fb265e533d811bebf9285d4618166b01f7d8f63dcc51aa93f8a

    • SHA512

      0b4a8b3728bbc666fb5077440b4da0cba09b235b6d8fd925ffcdf4b3e842b0aab6a911bee8a701c88ad1d2284f5b9ef5b499250863276b5203cab977c4c8f4b6

    • SSDEEP

      98304:Np2aqV1SQOv/u1ijP8vaiaD+hKFEutlW0z5uKWoXyl3dK:Ox/PORjEvF2WuSm5ooXyl34

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks