General
-
Target
9272ae628b9bced0b91ac3dc75dbbf597e0460fde8c3fbb154f9d50af7856f36
-
Size
5.1MB
-
Sample
240628-cb5hxsvejb
-
MD5
5cdc0a84809810763a5333fee557d86c
-
SHA1
fa49069e2c5180b5c9d893279d138ea9953cf3f7
-
SHA256
9272ae628b9bced0b91ac3dc75dbbf597e0460fde8c3fbb154f9d50af7856f36
-
SHA512
a9b703f84d5aee539807f14ff26599885c572bf21d7b2eb94ec9388e72cde3c11feb1fb14dba87cb30080291c4ce1ad365c0a480590b6f5108d86c42ca52f8e7
-
SSDEEP
98304:ChqLc30Xjll78254pmiulHjCY1TpTX8WKJjzMrPrkQxcMv:NO0Xj14pmZTh8nJjYrjkQW8
Static task
static1
Behavioral task
behavioral1
Sample
9272ae628b9bced0b91ac3dc75dbbf597e0460fde8c3fbb154f9d50af7856f36.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
9272ae628b9bced0b91ac3dc75dbbf597e0460fde8c3fbb154f9d50af7856f36.exe
Resource
win11-20240419-en
Malware Config
Extracted
socks5systemz
bevijyg.com
http://bevijyg.com/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f171ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff614c3e6929d3a
http://bevijyg.com/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12eab517aa5c96bd86ef9c814e855a8bbc896c58e713bc90c91f36b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9c9f38c4689117
bdjigcr.com
http://bdjigcr.com/search/?q=67e28dd83e55f3201607a91c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff614c3e6929d33
Targets
-
-
Target
9272ae628b9bced0b91ac3dc75dbbf597e0460fde8c3fbb154f9d50af7856f36
-
Size
5.1MB
-
MD5
5cdc0a84809810763a5333fee557d86c
-
SHA1
fa49069e2c5180b5c9d893279d138ea9953cf3f7
-
SHA256
9272ae628b9bced0b91ac3dc75dbbf597e0460fde8c3fbb154f9d50af7856f36
-
SHA512
a9b703f84d5aee539807f14ff26599885c572bf21d7b2eb94ec9388e72cde3c11feb1fb14dba87cb30080291c4ce1ad365c0a480590b6f5108d86c42ca52f8e7
-
SSDEEP
98304:ChqLc30Xjll78254pmiulHjCY1TpTX8WKJjzMrPrkQxcMv:NO0Xj14pmZTh8nJjYrjkQW8
Score10/10-
Detect Socks5Systemz Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-