Overview

overview

10

Static

static

3

871b6e5b29...f4.exe

windows7-x64

10

871b6e5b29...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    871b6e5b29c958ce5f6e16d76e19b491a7caa9c226614852c990a938e792eef4

  • Size

    6.3MB

  • Sample

    241104-xf6xrsvere

  • MD5

    4c34abe559275375d71522d0e9f4c931

  • SHA1

    9b0a7b14cc22a221ef9cdcdfed00367c594a4658

  • SHA256

    871b6e5b29c958ce5f6e16d76e19b491a7caa9c226614852c990a938e792eef4

  • SHA512

    640be4d94904295e866dfc65fed4d8691953284d509d95b06eb86c0eb0037d260b597d7e4f1833e3451ba9934ff12a030b1ee523f5e94a158c4448c0e39e49d9

  • SSDEEP

    196608:bJOGlcExxpwcemAjQwceQpSR1rA/xPJmVJ5iF4C:bUGL136jXhQp0rA+55C

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      871b6e5b29c958ce5f6e16d76e19b491a7caa9c226614852c990a938e792eef4

    • Size

      6.3MB

    • MD5

      4c34abe559275375d71522d0e9f4c931

    • SHA1

      9b0a7b14cc22a221ef9cdcdfed00367c594a4658

    • SHA256

      871b6e5b29c958ce5f6e16d76e19b491a7caa9c226614852c990a938e792eef4

    • SHA512

      640be4d94904295e866dfc65fed4d8691953284d509d95b06eb86c0eb0037d260b597d7e4f1833e3451ba9934ff12a030b1ee523f5e94a158c4448c0e39e49d9

    • SSDEEP

      196608:bJOGlcExxpwcemAjQwceQpSR1rA/xPJmVJ5iF4C:bUGL136jXhQp0rA+55C

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Socks5systemz family

      socks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks