General

  • Target

    d713bb99ac14f5efb9d3fb50451433b6fbf898d97e62ae836259520d6b43ee83

  • Size

    5.9MB

  • Sample

    241107-jrg6ws1mcm

  • MD5

    10b6199866daaa3e9e83026a333076d6

  • SHA1

    aca46e8abcb00ceca3719251660f1d42773b6a2f

  • SHA256

    d713bb99ac14f5efb9d3fb50451433b6fbf898d97e62ae836259520d6b43ee83

  • SHA512

    f95b539518035059420a7c1e04dd4c71de94aef3db88ecf689494a361708c53cf679a4488d5bd79d1af09dce0556881551520f309d18dad3952136c52bd3c8c1

  • SSDEEP

    98304:4YVZGK7YvOwWy0xfgz625eR+mzmRFRXIONzvJ/ByTIXlyYwXJcebJ9RnNdLiJNK:pjF7YS9fi55jm4zzhYTI3wZNbzRbL24

Malware Config

Targets

    • Target

      d713bb99ac14f5efb9d3fb50451433b6fbf898d97e62ae836259520d6b43ee83

    • Size

      5.9MB

    • MD5

      10b6199866daaa3e9e83026a333076d6

    • SHA1

      aca46e8abcb00ceca3719251660f1d42773b6a2f

    • SHA256

      d713bb99ac14f5efb9d3fb50451433b6fbf898d97e62ae836259520d6b43ee83

    • SHA512

      f95b539518035059420a7c1e04dd4c71de94aef3db88ecf689494a361708c53cf679a4488d5bd79d1af09dce0556881551520f309d18dad3952136c52bd3c8c1

    • SSDEEP

      98304:4YVZGK7YvOwWy0xfgz625eR+mzmRFRXIONzvJ/ByTIXlyYwXJcebJ9RnNdLiJNK:pjF7YS9fi55jm4zzhYTI3wZNbzRbL24

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks