General

  • Target

    ab654e2dce554e53877184cd2429dfa561ea14c77f0a67ae73454d13bc4572d6

  • Size

    3.8MB

  • Sample

    240810-en83zsvfjn

  • MD5

    f8542018a0cb32cc08b98fbdb2998559

  • SHA1

    fc57576b64596bef6834c2b62d86f48ce4ef993d

  • SHA256

    ab654e2dce554e53877184cd2429dfa561ea14c77f0a67ae73454d13bc4572d6

  • SHA512

    5412694dba71d0f335ac8532a558a2b1977d58177f8bb3f678cee1664706a71e7e6713d0f18f4fe32667472401f41e8f7891771e93827316825b87cc652681ec

  • SSDEEP

    98304:NlihtYghDdfPulmB35R6Um4OI53rEbW65tQk0J5IINdq:oJtml+TTms53hkh0Jqi8

Malware Config

Targets

    • Target

      ab654e2dce554e53877184cd2429dfa561ea14c77f0a67ae73454d13bc4572d6

    • Size

      3.8MB

    • MD5

      f8542018a0cb32cc08b98fbdb2998559

    • SHA1

      fc57576b64596bef6834c2b62d86f48ce4ef993d

    • SHA256

      ab654e2dce554e53877184cd2429dfa561ea14c77f0a67ae73454d13bc4572d6

    • SHA512

      5412694dba71d0f335ac8532a558a2b1977d58177f8bb3f678cee1664706a71e7e6713d0f18f4fe32667472401f41e8f7891771e93827316825b87cc652681ec

    • SSDEEP

      98304:NlihtYghDdfPulmB35R6Um4OI53rEbW65tQk0J5IINdq:oJtml+TTms53hkh0Jqi8

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks