General

  • Target

    a2b3aa5723bf1b4a79bb25278b9d87c41a09487b538af3b024f7735b0086ce79

  • Size

    3.7MB

  • Sample

    240812-jty77asblm

  • MD5

    02930c0d054dc0d452069e9d7d182d38

  • SHA1

    3832f17f2314fd5ee1c993fd9cd52b2870388016

  • SHA256

    a2b3aa5723bf1b4a79bb25278b9d87c41a09487b538af3b024f7735b0086ce79

  • SHA512

    5a18e91d65f5260f851a1b394f414f68695663acd13188eaeeed2452867bc0f5cd400a1240b8f16a8851526afb959e1aa608310e7ed62c48b25765cd64598112

  • SSDEEP

    49152:1va4KQ/txJMEiRXMzcnCuNTd6aglhBe+FFGZHaFifK8iJSGVSPOtFEz06gMRD78s:Na4gBLlIDWaFz8iJJFGz0Doc9Rd2dj

Malware Config

Targets

    • Target

      a2b3aa5723bf1b4a79bb25278b9d87c41a09487b538af3b024f7735b0086ce79

    • Size

      3.7MB

    • MD5

      02930c0d054dc0d452069e9d7d182d38

    • SHA1

      3832f17f2314fd5ee1c993fd9cd52b2870388016

    • SHA256

      a2b3aa5723bf1b4a79bb25278b9d87c41a09487b538af3b024f7735b0086ce79

    • SHA512

      5a18e91d65f5260f851a1b394f414f68695663acd13188eaeeed2452867bc0f5cd400a1240b8f16a8851526afb959e1aa608310e7ed62c48b25765cd64598112

    • SSDEEP

      49152:1va4KQ/txJMEiRXMzcnCuNTd6aglhBe+FFGZHaFifK8iJSGVSPOtFEz06gMRD78s:Na4gBLlIDWaFz8iJJFGz0Doc9Rd2dj

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks