General

  • Target

    8994c84d67c7f906b5f9af193b1f4a69e3a9157dfe5ad723d29d28d9949328dd

  • Size

    3.9MB

  • Sample

    240812-bylhwsygkq

  • MD5

    f56bf4aa0963b6570794ea2f3f985700

  • SHA1

    207ba7d409463cc6a774f766781bfd10e057c679

  • SHA256

    8994c84d67c7f906b5f9af193b1f4a69e3a9157dfe5ad723d29d28d9949328dd

  • SHA512

    4c0e44f0cd7033d8a9c058c51752295545e75fc49ba1caa36f577e05847bd0ff568703c78b247c0be57ed3fc422cce6f575412f8f5b677ba5e3f15629f707958

  • SSDEEP

    98304:NJh10ITboV0ej3IXuhhS6bGdKobgPBZyFOdX:p10ITbm023wMbAKp2FOV

Malware Config

Targets

    • Target

      8994c84d67c7f906b5f9af193b1f4a69e3a9157dfe5ad723d29d28d9949328dd

    • Size

      3.9MB

    • MD5

      f56bf4aa0963b6570794ea2f3f985700

    • SHA1

      207ba7d409463cc6a774f766781bfd10e057c679

    • SHA256

      8994c84d67c7f906b5f9af193b1f4a69e3a9157dfe5ad723d29d28d9949328dd

    • SHA512

      4c0e44f0cd7033d8a9c058c51752295545e75fc49ba1caa36f577e05847bd0ff568703c78b247c0be57ed3fc422cce6f575412f8f5b677ba5e3f15629f707958

    • SSDEEP

      98304:NJh10ITboV0ej3IXuhhS6bGdKobgPBZyFOdX:p10ITbm023wMbAKp2FOV

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks