Extracted

• • Target

    980e61666fe0254779c3c3a68fc670f68737ab29552e3001c81ea3e1c0e33c8e

  • Size

    2.9MB

  • MD5

    be421b490df6a035542f7d839b6a4494

  • SHA1

    75fe4cce076dfef3b092051cd7040b865b980d9d

  • SHA256

    980e61666fe0254779c3c3a68fc670f68737ab29552e3001c81ea3e1c0e33c8e

  • SHA512

    e2ede8df8cf81c295f57530d63f74906e68b9a177ffb77e3af5da1cce7156457522998cd06d6903bb9dac0061b7b48205fc83225d2f04cd6fd5399f61b6a4b97

  • SSDEEP

    49152:TG9P0OlhH01dAsg4/HI3PrTrHKo6SQHclfDa9ElXKXrMGCy4TGRMWYA8tsUM05:K9Pt21ng4/oDvxQHoamhsrMhKMUysUd5

  Score

  10^/10

  socks5systemzbotnetdiscovery

  • Detect Socks5Systemz Payload

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2