General

  • Target

    56199a6c3614618dd7ccd06ed53507b2838c36e9c7066ca9eb162d9d588cba7e

  • Size

    4.1MB

  • Sample

    240811-3dtgjstfrr

  • MD5

    a759210ee81306f0209134306b0f2557

  • SHA1

    40636881bed792b149cfb43d1ad950e55a6424cb

  • SHA256

    56199a6c3614618dd7ccd06ed53507b2838c36e9c7066ca9eb162d9d588cba7e

  • SHA512

    8ff14a888681870cf1555a65b62a1294b57e0cf76523c9064d945c5e449d20ac081a33ab0f11a09224281babdeca419e436e0c09e5e1a57c4deabcc9a37ec570

  • SSDEEP

    98304:NJJMqI/B3bknj3oo9r7USvJTljfuc4UdF6iuURdX:LC/+4SJvJTljfuc4UdF6N+V

Malware Config

Targets

    • Target

      56199a6c3614618dd7ccd06ed53507b2838c36e9c7066ca9eb162d9d588cba7e

    • Size

      4.1MB

    • MD5

      a759210ee81306f0209134306b0f2557

    • SHA1

      40636881bed792b149cfb43d1ad950e55a6424cb

    • SHA256

      56199a6c3614618dd7ccd06ed53507b2838c36e9c7066ca9eb162d9d588cba7e

    • SHA512

      8ff14a888681870cf1555a65b62a1294b57e0cf76523c9064d945c5e449d20ac081a33ab0f11a09224281babdeca419e436e0c09e5e1a57c4deabcc9a37ec570

    • SSDEEP

      98304:NJJMqI/B3bknj3oo9r7USvJTljfuc4UdF6iuURdX:LC/+4SJvJTljfuc4UdF6N+V

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks