Overview

overview

10

Static

static

3

a757f4bd8a...4a.exe

windows7-x64

10

a757f4bd8a...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a757f4bd8a0c8226291c0df2156ca816e050070346905c76948e4342f298cb4a

  • Size

    5.3MB

  • Sample

    241104-y6fnyaxblr

  • MD5

    5f650adc8a153cee8d970030f9accbb2

  • SHA1

    12b93748a93b088c87f897c03d6573e6a8609f90

  • SHA256

    a757f4bd8a0c8226291c0df2156ca816e050070346905c76948e4342f298cb4a

  • SHA512

    6d5fdf0164f1b4c7d2c9d9ef759bdf115ac2401e7e9c70e46791953871acbfe9a609e43010181f31d80be8121d02bb8ad3130b9832d34a251d8a9c33f55b8187

  • SSDEEP

    98304:eMzQvKprVdrZcHFesgk0/g++yasE7tfiBDrOZwGyX86treLYiqCx42:3zdrTZcon//+ywtfKn+wGyXhyICx42

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      a757f4bd8a0c8226291c0df2156ca816e050070346905c76948e4342f298cb4a

    • Size

      5.3MB

    • MD5

      5f650adc8a153cee8d970030f9accbb2

    • SHA1

      12b93748a93b088c87f897c03d6573e6a8609f90

    • SHA256

      a757f4bd8a0c8226291c0df2156ca816e050070346905c76948e4342f298cb4a

    • SHA512

      6d5fdf0164f1b4c7d2c9d9ef759bdf115ac2401e7e9c70e46791953871acbfe9a609e43010181f31d80be8121d02bb8ad3130b9832d34a251d8a9c33f55b8187

    • SSDEEP

      98304:eMzQvKprVdrZcHFesgk0/g++yasE7tfiBDrOZwGyX86treLYiqCx42:3zdrTZcon//+ywtfKn+wGyXhyICx42

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Socks5systemz family

      socks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks