MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011
SHA3-384 hash:	3e57e8f7102ad2aeed49d55693ba2aa75cfdbd93ef99f278ee9852c55c06e189fd1ef97f75542719b7a809ec36f9f78c
SHA1 hash:	b7fa61cc002074086a205e174f789254b20cfe3d
MD5 hash:	eec8d3f23702ffbb6171b7b615165ae1
humanhash:	quebec-zebra-whiskey-robin
File name:	SecuriteInfo.com.Trojan.Siggen22.38764.6846.117
Download:	download sample
Signature	Socks5Systemz Alert Create hunting rule
File size:	7'335'412 bytes
First seen:	2023-12-16 15:21:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'565 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	196608:2Ab4Ov/Hirx7Tc8WfIpevtyEDj88cnEhIkmZszj:2hcirx7g4pq88aZszj
Threatray	6'902 similar samples on MalwareBazaar
TLSH	T14B7633E1A220D4F2F81367B1582092500E353AC452F444CCB5FEAB9FDE7A48F9E56B57
TrID	76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe Socks5Systemz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

278

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468038/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen22.38764.6846.117.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Moving a file to the Program Files subdirectory

Modifying a system file

Creating a file

Creating a service

Sending a custom TCP request

Enabling autorun for a service

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/657dc09dffafd83ebc91b402/reports/62090452-b686-4e03-9666-6531f7803e96/overview

Hybrid Analysis HEUR/AGEN.1332570

Verdict:

Suspicious

Labled as:

HEUR/AGEN.1332570

Link:

https://www.hybrid-analysis.com/sample/095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/a96182d0-1417-4520-ab63-9457d522eae2

Joe Sandbox Petite Virus, Socks5Systemz

Result

Threat name:

Petite Virus, Socks5Systemz

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363425

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

PE file has nameless sections

Snort IDS alert for network traffic

Yara detected Petite Virus

Yara detected Socks5Systemz

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

75%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 15:22:08 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

10 of 23 (43.48%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bfoxwazd4upuaiphtpgorvv25m4boq4jcv72rvf4fkwgfvageaiq._file

Threatray malicious

Verdict:

malicious

Similar samples:

19aaa18d707ab1a3cb98c4a257c1cd8e8e2594b697aaffc2687539583810a653

Socks5Systemz

22a14d248853472bf27c94cc3b506b524673f5c52823b7e6bd470e067c34a3e9

Socks5Systemz

6de07b921c1697555b4ca043c5a1b8bd75356c92e23d6a472b30b46966476863

Socks5Systemz

82ffaa01c0b5847399e6e210f100d2559eeff6651fe0a70735c1ed3f0ecc1182

Socks5Systemz

99f303475707b9d778b855f038c8b8c42104c753bd5fa26c168b25a7e552a0f9

Socks5Systemz

aace929793e89d54fc77801417b9ebd301f51ab027f2b10475279b01aa48368c

Socks5Systemz

e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e

Socks5Systemz

+ 6'892 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/231216-srwtqabhfm/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

UnpacMe INDICATOR_EXE_Packed_VMProtect

Unpacked files

SH256 hash:

860ce6b152a3e12ca0336d114c24a7c266aa0b16e033a1388a69d11c21777fb9

MD5 hash:

0edd953d13c6dabd5abcf327e5f28a56

SHA1 hash:

aa419577cbaf4a85102fcbc72ddaa3396a3398b5

Detections:

INDICATOR_EXE_Packed_VMProtect

Alert

Create hunting rule

Link:

https://www.unpac.me/results/064871d2-fe3c-4905-8d53-c6618f0d4db8/

Parent samples :

e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e
aace929793e89d54fc77801417b9ebd301f51ab027f2b10475279b01aa48368c
19aaa18d707ab1a3cb98c4a257c1cd8e8e2594b697aaffc2687539583810a653
82ffaa01c0b5847399e6e210f100d2559eeff6651fe0a70735c1ed3f0ecc1182
6de07b921c1697555b4ca043c5a1b8bd75356c92e23d6a472b30b46966476863
99f303475707b9d778b855f038c8b8c42104c753bd5fa26c168b25a7e552a0f9
22a14d248853472bf27c94cc3b506b524673f5c52823b7e6bd470e067c34a3e9
095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011
5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

SH256 hash:

bfe1ab607dfba71517a995a31be6628c8673dc723660804fd30f374d3989359c

MD5 hash:

e82f019ab3c2e83c05abd197c7912003

SHA1 hash:

a705c9f56bc7d7d0c6591d23337d89fdbabce756

Link:

https://www.unpac.me/results/064871d2-fe3c-4905-8d53-c6618f0d4db8/

SH256 hash:

1bdbc2e1e1a6757f414ddd3f752e243fb85848212a1d79cae1fb2db307279546

MD5 hash:

1393de8c10f6f20cbaf109849d016aa4

SHA1 hash:

f901ae2b561b1b59a94dcfc5205e75f658ec0d0d

Link:

https://www.unpac.me/results/064871d2-fe3c-4905-8d53-c6618f0d4db8/

SH256 hash:

669e8240641bdf7d9843a0cfa39f5746e6d73cfc1f7f5552b3406e89ac52dc89

MD5 hash:

5e5221be2ba6c68f871c60abf77d1644

SHA1 hash:

c0c6f749684e98e69f67529720c41888ca274413

Link:

https://www.unpac.me/results/064871d2-fe3c-4905-8d53-c6618f0d4db8/

SH256 hash:

d4f52b7d966c476dee40c677a9d9f224e55c592ee287660cd292e91eccd11848

MD5 hash:

9824254bb5cd741b93eec8e623580685

SHA1 hash:

0de975cd3955849f4c668eed5bb5f8b45f940d36

Link:

https://www.unpac.me/results/064871d2-fe3c-4905-8d53-c6618f0d4db8/

SH256 hash:

095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011

MD5 hash:

eec8d3f23702ffbb6171b7b615165ae1

SHA1 hash:

b7fa61cc002074086a205e174f789254b20cfe3d

Link:

https://www.unpac.me/results/064871d2-fe3c-4905-8d53-c6618f0d4db8/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468038/