Overview

overview

10

Static

static

3

53427ea40d...bN.exe

windows7-x64

10

53427ea40d...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53427ea40d3afcc96727efdc014f7df163ab96c01f8e6bf1ad1edc4343a3c51bN

  • Size

    2.9MB

  • Sample

    241004-qjse8awcpp

  • MD5

    820f130276e9167e2ab4457c9ae353c0

  • SHA1

    f37d9cd520e36669a88b5d7c09f512912b1d3c17

  • SHA256

    53427ea40d3afcc96727efdc014f7df163ab96c01f8e6bf1ad1edc4343a3c51b

  • SHA512

    75e84bd5bf4a2bf286780718dee0c174a43f03d816d3fefab178b2ef3483507d1a520b5caa6495ace9c2d143e7bccc4592663e503f86c7cd0868d044d782e35e

  • SSDEEP

    49152:a6dsy+GZeBtFUZtDw0m9XlNYoZNA4ITLMSJGXl6G9Kc/CjYwCDHF7Hg0C9cgKezY:xdJlOoCLlNYoZOTLZGX2c/KPoHFbCYe0

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      53427ea40d3afcc96727efdc014f7df163ab96c01f8e6bf1ad1edc4343a3c51bN

    • Size

      2.9MB

    • MD5

      820f130276e9167e2ab4457c9ae353c0

    • SHA1

      f37d9cd520e36669a88b5d7c09f512912b1d3c17

    • SHA256

      53427ea40d3afcc96727efdc014f7df163ab96c01f8e6bf1ad1edc4343a3c51b

    • SHA512

      75e84bd5bf4a2bf286780718dee0c174a43f03d816d3fefab178b2ef3483507d1a520b5caa6495ace9c2d143e7bccc4592663e503f86c7cd0868d044d782e35e

    • SSDEEP

      49152:a6dsy+GZeBtFUZtDw0m9XlNYoZNA4ITLMSJGXl6G9Kc/CjYwCDHF7Hg0C9cgKezY:xdJlOoCLlNYoZOTLZGX2c/KPoHFbCYe0

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks