General

  • Target

    86cc85e23bceb2c25e6fca4730665bb82d4076aa812d976c8875cc35db316b06

  • Size

    4.6MB

  • Sample

    241112-ezd2zstnd1

  • MD5

    e2021bef160a982d7dd2221833d31ef2

  • SHA1

    d293d2971a4bca452b8404741becbf8fbf97b0c0

  • SHA256

    86cc85e23bceb2c25e6fca4730665bb82d4076aa812d976c8875cc35db316b06

  • SHA512

    95943ddb1c9107b570e27bc21be4ce12878e242315761a588e28a7916ec9e88ed3165c623e104e3dfaef5ce42214d9e4c828fb2e66157499e39559262f74f0f9

  • SSDEEP

    98304:4I2lDx71lEXYcOJcx3+LuJM17+3lcC1uZMqm9nzQ6OYj1/Q4ElviEZ/57hs3sz:Itx71YOJcx3+LuJi7+3lv1uGJzQ9811e

Malware Config

Targets

    • Target

      86cc85e23bceb2c25e6fca4730665bb82d4076aa812d976c8875cc35db316b06

    • Size

      4.6MB

    • MD5

      e2021bef160a982d7dd2221833d31ef2

    • SHA1

      d293d2971a4bca452b8404741becbf8fbf97b0c0

    • SHA256

      86cc85e23bceb2c25e6fca4730665bb82d4076aa812d976c8875cc35db316b06

    • SHA512

      95943ddb1c9107b570e27bc21be4ce12878e242315761a588e28a7916ec9e88ed3165c623e104e3dfaef5ce42214d9e4c828fb2e66157499e39559262f74f0f9

    • SSDEEP

      98304:4I2lDx71lEXYcOJcx3+LuJM17+3lcC1uZMqm9nzQ6OYj1/Q4ElviEZ/57hs3sz:Itx71YOJcx3+LuJi7+3lv1uGJzQ9811e

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks