General

  • Target

    30414f3ba4fafbda6f458ec830b5c1ac40e39d983c973c20ef4c7c6646dcbb86

  • Size

    5.8MB

  • Sample

    241118-lkajkstfrl

  • MD5

    ce7f0436845a009c7b28c14eeb9e73cf

  • SHA1

    faba9be3e2b54d07ed5edd40dbba2697871def71

  • SHA256

    30414f3ba4fafbda6f458ec830b5c1ac40e39d983c973c20ef4c7c6646dcbb86

  • SHA512

    dd73bcda2d8cb37198224451eee707d8ae073fc274cd6ecea85e2ab8d2a2c9a50c3413d140c3479177491eeb5c8c894087bd1308ddd9f7d513298bb1232d3390

  • SSDEEP

    98304:Np0dW+wqU16daombR3fujifiFc5put6gJ+AdmOfD+Nmos0NtXnMBtM0P6zLM/dmp:z0D5U1OaowvueeO7gqx5nMB1P6zw/S

Malware Config

Targets

    • Target

      30414f3ba4fafbda6f458ec830b5c1ac40e39d983c973c20ef4c7c6646dcbb86

    • Size

      5.8MB

    • MD5

      ce7f0436845a009c7b28c14eeb9e73cf

    • SHA1

      faba9be3e2b54d07ed5edd40dbba2697871def71

    • SHA256

      30414f3ba4fafbda6f458ec830b5c1ac40e39d983c973c20ef4c7c6646dcbb86

    • SHA512

      dd73bcda2d8cb37198224451eee707d8ae073fc274cd6ecea85e2ab8d2a2c9a50c3413d140c3479177491eeb5c8c894087bd1308ddd9f7d513298bb1232d3390

    • SSDEEP

      98304:Np0dW+wqU16daombR3fujifiFc5put6gJ+AdmOfD+Nmos0NtXnMBtM0P6zLM/dmp:z0D5U1OaowvueeO7gqx5nMB1P6zw/S

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks