Overview

overview

10

Static

static

3

f1ff8b8756...72.exe

windows7-x64

10

f1ff8b8756...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1ff8b875608dc5de647df6b6e89d96e89d70b62828ffce9e40189581f89e472

  • Size

    5.8MB

  • Sample

    241111-xzmm8sthrp

  • MD5

    82fbc09c0dd3c62abaa63478b632d447

  • SHA1

    5c08d5771b866f346406d27dd63c31dcbaf5b499

  • SHA256

    f1ff8b875608dc5de647df6b6e89d96e89d70b62828ffce9e40189581f89e472

  • SHA512

    fa6cd32e00df1daa62b3ffe9f96fa74d61032ef7815777aad7dbb96070935ad8149bb78cc9bf94a56cfdb0fb9bc7e6e5e242af8ac0c3f06f0c079c1606f3bf56

  • SSDEEP

    98304:418g519ejuzhEYbdl1QFnSQImn4eiyiZX9WmUkoIgEwnrRgpFAUaMT:S2jA+YlQFSQIm4m6XfDgEwrG7/

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      f1ff8b875608dc5de647df6b6e89d96e89d70b62828ffce9e40189581f89e472

    • Size

      5.8MB

    • MD5

      82fbc09c0dd3c62abaa63478b632d447

    • SHA1

      5c08d5771b866f346406d27dd63c31dcbaf5b499

    • SHA256

      f1ff8b875608dc5de647df6b6e89d96e89d70b62828ffce9e40189581f89e472

    • SHA512

      fa6cd32e00df1daa62b3ffe9f96fa74d61032ef7815777aad7dbb96070935ad8149bb78cc9bf94a56cfdb0fb9bc7e6e5e242af8ac0c3f06f0c079c1606f3bf56

    • SSDEEP

      98304:418g519ejuzhEYbdl1QFnSQImn4eiyiZX9WmUkoIgEwnrRgpFAUaMT:S2jA+YlQFSQIm4m6XfDgEwrG7/

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Socks5systemz family

      socks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks