MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da
SHA3-384 hash: d0d8111a5c60bf3a8e824ca2be530649dc476fa5830641e5d2ffba5c0a18233e8a814c495db230009c1a7fae5ceb7437
SHA1 hash: ff589614c244b095ae79ec600efa7b8000952298
MD5 hash: 5e8dbe3403aa3fe779fb5c60b449f159
humanhash: crazy-artist-hydrogen-kitten
File name:5e8dbe3403aa3fe779fb5c60b449f159
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:6'550'877 bytes
First seen:2024-01-30 14:51:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'513 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 196608:blswAg7BTqNvQHAhHnpVu7NUtcPNc/ctZSPGUGh03w:ZeCWNvQEpVuhUtcPNgcjSPOcw
Threatray 52 similar samples on MalwareBazaar
TLSH T19F663392C631F639D1044FB2D528842A6B765EA51B393E7D60CFD02FEB03E882B4D657
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe Socks5Systemz

Intelligence

File Origin
# of uploads :
1
# of downloads :
373
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/473606/
Detection(s):
SecuriteInfo.com.UntrustedCertificate.OpenCandy7AF.8482.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65b90d1e814c2aeb14854445/reports/a7d4e5f5-7a02-420a-b643-fead551e415f/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4ebe4c7c-23d2-4f70-a402-6ea688f33a43
Result
Threat name:
Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1383359
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil
Snort IDS alert for network traffic
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
Score:
26%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2024-01-30 14:52:08 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpsijg5ufc3oolwpke3qinzat2nbdarkza2kwfc6wwr5mu4x6pna._file
Verdict:
malicious
Similar samples:
394e0d9539926c7a13e02139746e519868c5b1c91cf75df3fa83f0df182559a9
Socks5Systemz
3b0ea10dc08e2bfa8f1355a3e6ab72f9d06aad7dbf4961a6220d72ef72acb0b0
Socks5Systemz
5ac704060ed9716d8b6774e82e6f8cad20e41ad9c4dc8bd57cab9550aca4f4bc
Socks5Systemz
5fb04dd2f4c026af1ac7a9ec258f029367eb227c8e0ae8e854f33544868bf0bd
Socks5Systemz
83d85859a5c64caf407816eeea421be327483de6798ae2cdcf0fa87713afe5e5
Socks5Systemz
98dd0b13309f39e81a6078648b6f533f6ea409b314b41cba394305b379767ac0
Socks5Systemz
f4953dd47a1a35b12a94ce5c4fc5af2da86882070366a1684b8896a16bf636ec
Socks5Systemz
+ 42 additional samples on MalwareBazaar
Result
Malware family:
socks5systemz
Create hunting rule
Score:
  10/10
Tags:
family:socks5systemz botnet discovery
Link:
https://tria.ge/reports/240130-r8qhlagge8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Detect Socks5Systemz Payload
Socks5Systemz
Unpacked files
SH256 hash:
046888c845fa8c1e0c2c02cfc92deb19f6051bbd9ae2df4b2bd7aa81e8721724
MD5 hash:
5f7c520b20b1b06aee487593d3a8579c
SHA1 hash:
a281952adb05a027ab2a11af84c29b8b1225338a
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
109c76d4578bb7d77554a360734ec55650436358faba9878a1290baac78ed859
MD5 hash:
482e1c9594e09873551a743aa376afa8
SHA1 hash:
37384a0fec165fc5f07c5d560527020b7176f3ba
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
f384411f0bdf3b9f15afe23fd16a000034374fc9c61dfab5fd4c43a6adf2319a
MD5 hash:
bb0eb72b328106653ad3e612ffbcbad3
SHA1 hash:
43f5a80904b3963784a53c4edb4d0160b7e0a039
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2
MD5 hash:
0ee914c6f0bb93996c75941e1ad629c6
SHA1 hash:
12e2cb05506ee3e82046c41510f39a258a5e5549
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
8e65546a2f552c1b7164aa2b537f4097904173d01efcd1ecb1a737ee99008141
MD5 hash:
a28e0b7d6a4152ac8941fea442e71d00
SHA1 hash:
abc10fab4c091c169db94063b3ca9b6c52dbbdcd
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
8bc5696fb675bc985d52a35eee1cb84260da7e51514b5defddba8d0af66bac32
MD5 hash:
e0f1d5754006de39562d8bd0a0c7cb5f
SHA1 hash:
30c38c1c47dbe37a1408b9c89346d5d9b7ea0709
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
SH256 hash:
1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da
MD5 hash:
5e8dbe3403aa3fe779fb5c60b449f159
SHA1 hash:
ff589614c244b095ae79ec600efa7b8000952298
Link:
https://www.unpac.me/results/7fe479e7-0db1-4aad-bc4e-6bebfc1c1f19/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe 1be4849bb428b6e72ecf51370437209e9a11822ac834ab145eb5a3d65397f3da

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2751452/
  
URLhaus
https://urlhaus.abuse.ch/url/2753611/
Cape
Cape
https://www.capesandbox.com/analysis/473606/
  
URLhaus
https://urlhaus.abuse.ch/url/2753646/
  
URLhaus
https://urlhaus.abuse.ch/url/2753651/
  
URLhaus
https://urlhaus.abuse.ch/url/2753652/
  
URLhaus
https://urlhaus.abuse.ch/url/2753653/
  
URLhaus
https://urlhaus.abuse.ch/url/2753666/
  
URLhaus
https://urlhaus.abuse.ch/url/2753610/
  
URLhaus
https://urlhaus.abuse.ch/url/2753657/

Comments


Avatar
zbet commented on 2024-01-30 14:51:45 UTC

url : hxxp://ok.spartabig.com/order/tuc6.exe