MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
SHA3-384 hash: fe7a8ec682c7bdabe51787c973a6e88aeb156368a21797e1d49e171242abd6185f6e547485ceac97783007a941644592
SHA1 hash: 4968ecbbc322cc9f68c3a644bf69e583971ece17
MD5 hash: 600e74b40a5c566e91cb30cac80455c9
humanhash: colorado-social-magazine-paris
File name:600e74b40a5c566e91cb30cac80455c9
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:7'054'359 bytes
First seen:2023-12-21 17:34:24 UTC
Last seen:2023-12-21 19:19:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'538 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 98304:j4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:Mh7teThPZidcKj8fPz6+4jb1KswNdDJF
Threatray 3'736 similar samples on MalwareBazaar
TLSH T109663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe Socks5Systemz

Intelligence

File Origin
# of uploads :
2
# of downloads :
295
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/468840/
Detection(s):
SecuriteInfo.com.Trojan.Siggen22.47135.5764.23977.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/6584774a7d4bdb7f8bf9bb25/reports/d9f2186d-0959-4b42-8bb0-fb69f6cc65c0/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6e30b3a5-02bf-4450-a78c-63cdf54ae974
Result
Threat name:
Petite Virus, Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1365721
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
PE file has nameless sections
Snort IDS alert for network traffic
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1365721 Sample: rdIhz2L11B.exe Startdate: 21/12/2023 Architecture: WINDOWS Score: 100 46 Snort IDS alert for network traffic 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 Detected unpacking (changes PE section rights) 2->50 52 6 other signatures 2->52 8 rdIhz2L11B.exe 2 2->8         started        11 svchost.exe 3 14 2->11         started        process3 file4 32 C:\Users\user\AppData\...\rdIhz2L11B.tmp, PE32 8->32 dropped 13 rdIhz2L11B.tmp 17 71 8->13         started        16 WerFault.exe 2 11->16         started        18 WerFault.exe 2 11->18         started        process5 file6 34 C:\Program Files (x86)\...\rbuttontray.exe, PE32 13->34 dropped 36 C:\Program Files (x86)\...\is-TFV3V.tmp, PE32 13->36 dropped 38 C:\Program Files (x86)\...\is-0D00A.tmp, PE32 13->38 dropped 40 99 other files (none is malicious) 13->40 dropped 20 rbuttontray.exe 1 15 13->20         started        23 rbuttontray.exe 1 2 13->23         started        process7 dnsIp8 42 ercpiud.ua 185.196.8.22, 49738, 49741, 49742 SIMPLECARRER2IT Switzerland 20->42 44 95.216.227.177, 2023, 49739, 49740 HETZNER-ASDE Germany 20->44 30 C:\ProgramData\PDiskSnap76\PDiskSnap76.exe, PE32 23->30 dropped 26 WerFault.exe 21 16 23->26         started        28 WerFault.exe 16 23->28         started        file9 process10
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ac5gbrjvwiclnimoxyvcpec5txwrkbzf2stkg5horraglvtxupuq._file
Verdict:
malicious
Similar samples:
2d99fc04c07bcbb87ce1924199570c3a141183389adc60cd2b30571ab8122e16
Socks5Systemz
47faba85acbea0576e7006d53edc27352a95afb100fa60234e57b41d4a3d5cd7
Socks5Systemz
930bed06faf3901edb03f37ad01b44e7510f112b98e898e0addc99c31a146d7d
Socks5Systemz
b4ecc5343955cdb23df3e6b83aced689ba863446522a70846db453e5ba0e89f8
Socks5Systemz
b68a7b8dd9c38abd30e56aa95f2ab80519b9d5fdbff1a726ed231891f04edae5
Socks5Systemz
d7c0c7650124d5fc3ceb01652ae9b3f54898797bdb77733333b80be530f44814
Socks5Systemz
f95e2ed824d17844bbe1277cf764fbc769bcccd8d38cda03ca30f4c7b98eedbd
Socks5Systemz
+ 3'726 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/231221-v5z5eabcfm/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
ee1a3c1100dec8fd23709a7245944c8b65841810b37e2d90de9c3f45c0ac68cb
MD5 hash:
2dd87dbeca4a27b80fcf71e09fb953b7
SHA1 hash:
0183fccc631fd0ad12d1e711924c99d18a205b88
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/292aa758-1978-4c7a-b220-05c94430c2f5/
Parent samples :
f95e2ed824d17844bbe1277cf764fbc769bcccd8d38cda03ca30f4c7b98eedbd
f191ecdd2e5bfa3159591ed10b4b88437f56fbc917d817489372b7dd634b991b
2d99fc04c07bcbb87ce1924199570c3a141183389adc60cd2b30571ab8122e16
b4ecc5343955cdb23df3e6b83aced689ba863446522a70846db453e5ba0e89f8
b68a7b8dd9c38abd30e56aa95f2ab80519b9d5fdbff1a726ed231891f04edae5
8e8433d03b7a1a6c5bcd623ffb4a55014516e6afe0ee1974a9ab42da56326003
d7c0c7650124d5fc3ceb01652ae9b3f54898797bdb77733333b80be530f44814
47faba85acbea0576e7006d53edc27352a95afb100fa60234e57b41d4a3d5cd7
00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
c3d49b625f72eb6ce52ddbcfa28ddea1b0cbda77dab0df8cc13bd05a05414a49
ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
af72d998606947486a87fd2c1dd93afa42154511ee5c4b220d3f1aa07426cd91
a080de20aa321af83e8570c5bf58f3f3644b043d807a3acabed4e546eb49a6c2
SH256 hash:
74c7ef0d21748df5aa4be5f4479136cdd8d722a71114587edf1e041b3d8ccefe
MD5 hash:
ab79ef68155e5bde1f434e1311f3ff74
SHA1 hash:
843d5f1f1a751256f505f7a63090ddbeebd45192
Link:
https://www.unpac.me/results/292aa758-1978-4c7a-b220-05c94430c2f5/
SH256 hash:
948c2fd7dedd2f1f2c9f570af24ffac3a9038adc2f3c26a8bddde29c46df2c2b
MD5 hash:
298e299970dc5342d9ff8f825874a2b3
SHA1 hash:
2b1f6e172943c873cc6a5bda761251953e851f0d
Link:
https://www.unpac.me/results/292aa758-1978-4c7a-b220-05c94430c2f5/
SH256 hash:
00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
MD5 hash:
600e74b40a5c566e91cb30cac80455c9
SHA1 hash:
4968ecbbc322cc9f68c3a644bf69e583971ece17
Link:
https://www.unpac.me/results/292aa758-1978-4c7a-b220-05c94430c2f5/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe 00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468840/

Comments


Avatar
zbet commented on 2023-12-21 17:34:25 UTC

url : hxxp://zen.topteamlife.com/order/adobe.exe