General

  • Target

    656d065f8b618c596506fcc2c845791384f4e647a247c9f5fb07eb091ff5abba

  • Size

    5.8MB

  • Sample

    241118-k9rnqasrgz

  • MD5

    036e1cb3bb3b612e9bd83425b3939c88

  • SHA1

    c6082d5536797a8986f8f5a39e6332595a2b4331

  • SHA256

    656d065f8b618c596506fcc2c845791384f4e647a247c9f5fb07eb091ff5abba

  • SHA512

    47a6b3e8158783ffd64446e79287402f232274719352989787d8571d78d86f7cb74594726430a7a27ea2c7e63e589df6cd4d685226c74dd828d074ae6786ab26

  • SSDEEP

    98304:NS00eNnnrD89eZQ9iFXiR9Gw0rZS2OaqekunvCfk/uACjVg124Fl8UKTziIiqstS:bNnX8EsparZS2cekuqckjBx/ejq+S

Malware Config

Targets

    • Target

      656d065f8b618c596506fcc2c845791384f4e647a247c9f5fb07eb091ff5abba

    • Size

      5.8MB

    • MD5

      036e1cb3bb3b612e9bd83425b3939c88

    • SHA1

      c6082d5536797a8986f8f5a39e6332595a2b4331

    • SHA256

      656d065f8b618c596506fcc2c845791384f4e647a247c9f5fb07eb091ff5abba

    • SHA512

      47a6b3e8158783ffd64446e79287402f232274719352989787d8571d78d86f7cb74594726430a7a27ea2c7e63e589df6cd4d685226c74dd828d074ae6786ab26

    • SSDEEP

      98304:NS00eNnnrD89eZQ9iFXiR9Gw0rZS2OaqekunvCfk/uACjVg124Fl8UKTziIiqstS:bNnX8EsparZS2cekuqckjBx/ejq+S

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks