General

  • Target

    596e861f878f215439102174a954a8df67044ddcabbed121f2c4e7d2faf0d75c

  • Size

    3.9MB

  • Sample

    240812-kenzcatajn

  • MD5

    3acce11467462cd9fc0689b32ca7d33c

  • SHA1

    eec095667f9bad251655380cf7c953c88bbf5625

  • SHA256

    596e861f878f215439102174a954a8df67044ddcabbed121f2c4e7d2faf0d75c

  • SHA512

    eb1640bf85876efc2108454429af5a1c7b932c7055ec7294331adeac5fd50b23f88a27c10400aa0eb964b2a57c759c7277d7a2130af87d4dbdf27bb41c0ad42d

  • SSDEEP

    98304:N+Bn3sEh3f+yGR9NJHZuV0ilubz84v++8qh9hI6PM8ae2dj:bQGRJHgV0TbL1RajR

Malware Config

Targets

    • Target

      596e861f878f215439102174a954a8df67044ddcabbed121f2c4e7d2faf0d75c

    • Size

      3.9MB

    • MD5

      3acce11467462cd9fc0689b32ca7d33c

    • SHA1

      eec095667f9bad251655380cf7c953c88bbf5625

    • SHA256

      596e861f878f215439102174a954a8df67044ddcabbed121f2c4e7d2faf0d75c

    • SHA512

      eb1640bf85876efc2108454429af5a1c7b932c7055ec7294331adeac5fd50b23f88a27c10400aa0eb964b2a57c759c7277d7a2130af87d4dbdf27bb41c0ad42d

    • SSDEEP

      98304:N+Bn3sEh3f+yGR9NJHZuV0ilubz84v++8qh9hI6PM8ae2dj:bQGRJHgV0TbL1RajR

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks