Overview

overview

10

Static

static

3

482d600a54...b3.exe

windows7-x64

10

482d600a54...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    482d600a54dbec4c12874487f583af2095ddcfaec03c54498fd6e7ec46d33cb3

  • Size

    6.1MB

  • Sample

    241104-3ct2pazbnc

  • MD5

    c791c6e24c40dd4140640259ccbbf8f1

  • SHA1

    80aacfb115eaff36767cde5af0e563c955ce9d8b

  • SHA256

    482d600a54dbec4c12874487f583af2095ddcfaec03c54498fd6e7ec46d33cb3

  • SHA512

    2574f4069431b58de8aeb140336534db0b02071376dc06e4cfb560e1e85ad53188d1610a13263387ddb63664024a0f74101ce18462f4ab7de366eac8a1543512

  • SSDEEP

    196608:m1dSppr+ppQyoltASlCiZHX5jy88kPO6d:8kpr+UZtZljXP8q

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      482d600a54dbec4c12874487f583af2095ddcfaec03c54498fd6e7ec46d33cb3

    • Size

      6.1MB

    • MD5

      c791c6e24c40dd4140640259ccbbf8f1

    • SHA1

      80aacfb115eaff36767cde5af0e563c955ce9d8b

    • SHA256

      482d600a54dbec4c12874487f583af2095ddcfaec03c54498fd6e7ec46d33cb3

    • SHA512

      2574f4069431b58de8aeb140336534db0b02071376dc06e4cfb560e1e85ad53188d1610a13263387ddb63664024a0f74101ce18462f4ab7de366eac8a1543512

    • SSDEEP

      196608:m1dSppr+ppQyoltASlCiZHX5jy88kPO6d:8kpr+UZtZljXP8q

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Socks5systemz family

      socks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks