Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee8b8213fb72bf85196b65164478f563ab79b6e9a6cd13e91b0ee1781108f38e

  • Size

    5.0MB

  • Sample

    240629-g8j1pswaqr

  • MD5

    bd6d75473394c6de28b3e2fb0a1a0a81

  • SHA1

    81c73ed251e2954b842ad30c488f00329a721ce5

  • SHA256

    ee8b8213fb72bf85196b65164478f563ab79b6e9a6cd13e91b0ee1781108f38e

  • SHA512

    718472653345091ecd3aef4c7b43503075b9f61d28ff42d6a8e035fc2387028190cb0b103d7774f0a4ec925d619355a4745b9a40c93016f399790862abc1c84b

  • SSDEEP

    98304:Clp2o6Zkdc//N2Y1NC7iuQy9x2q/AInh9yEyVT8kTIpn4YTFlyW25KtQmrADNLJK:gp95cHh4iZDq/X6hT8kTIyYfy/4tQm++

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      ee8b8213fb72bf85196b65164478f563ab79b6e9a6cd13e91b0ee1781108f38e

    • Size

      5.0MB

    • MD5

      bd6d75473394c6de28b3e2fb0a1a0a81

    • SHA1

      81c73ed251e2954b842ad30c488f00329a721ce5

    • SHA256

      ee8b8213fb72bf85196b65164478f563ab79b6e9a6cd13e91b0ee1781108f38e

    • SHA512

      718472653345091ecd3aef4c7b43503075b9f61d28ff42d6a8e035fc2387028190cb0b103d7774f0a4ec925d619355a4745b9a40c93016f399790862abc1c84b

    • SSDEEP

      98304:Clp2o6Zkdc//N2Y1NC7iuQy9x2q/AInh9yEyVT8kTIpn4YTFlyW25KtQmrADNLJK:gp95cHh4iZDq/X6hT8kTIyYfy/4tQm++

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks