MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b
SHA3-384 hash: 1ff9a99a06ee7762795a0cf59d43ccd53d41c5ff787c065a4811930baf72397f504809427b0fd915bd5126166a645b14
SHA1 hash: 590e60bd792ead11cbd507c4de8ca9f77a3757a9
MD5 hash: 3a8c9f010a87038a151bcee14aed51d5
humanhash: north-red-potato-salami
File name:3A8C9F010A87038A151BCEE14AED51D5.exe
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:7'992'596 bytes
First seen:2024-07-31 19:55:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e92b45c54aa05ec107d5ef90662e6b33 (363 x GCleaner, 38 x Socks5Systemz, 3 x Backdoor.TeamViewer)
ssdeep 196608:L55jmYtQnI3fBS5Bej4a+/0ZjZ+9DsypiKIsV7VV0FGtCKde3IZy5:LOOeBeq/0X+9DWKIsBEFGtCk4I8
Threatray 162 similar samples on MalwareBazaar
TLSH T148863362F58481B0F0E5D6F21F53B8376872BA7623B5D2FC97EA4C148E295E4236271C
TrID 82.5% (.EXE) Inno Setup installer (107240/4/30)
10.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.4% (.EXE) Win32 Executable (generic) (4504/4/1)
1.5% (.EXE) Generic Win/DOS Executable (2002/3)
1.5% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter abuse_ch
Tags:exe Socks5Systemz


Avatar
abuse_ch
Socks5Systemz C2:
185.196.8.214:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.196.8.214:80 https://threatfox.abuse.ch/ioc/1305426/

Intelligence

File Origin
# of uploads :
1
# of downloads :
393
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3A8C9F010A87038A151BCEE14AED51D5.exe
Verdict:
Malicious activity
Analysis date:
2024-07-31 19:56:38 UTC
Tags:
installer
Link:
https://app.any.run/tasks/8e98890e-bc5e-4a87-b4ff-1e76b45f289c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66aa96d6b7a04efc7439795a
Tags:
Encryption Generic Stealth Trojan Nekark
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Creating a file
Moving a recently created file
Modifying a system file
Creating a service
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
borland_delphi fingerprint installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/66aa96e0dfa8b2fced507a65/reports/6d71423c-ec84-4ccf-ada9-e32a12924661/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bd1b32f3-533d-4ba8-bec4-c121fb81f394
Result
Threat name:
Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1485606
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
Score:
33%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2024-07-23 12:41:47 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ewhm2hfrkorkiufnkqcpprk2pxvej3nvjwtfb75bczoxcwg65ffq._file
Verdict:
malicious
Similar samples:
12799551e5f50de2d5bec3973d53e745d66b4f41ede09197630a8b6cdac296c2
Socks5Systemz
739390cb2a8719293c06192017f6164ed68e569f5d259de14f17e9b6dee8ea44
Socks5Systemz
836702e8e9b5cc72d071836f7aece14f2f55103db492110feb3d1df399cb5a7e
Socks5Systemz
a9e0912c51dbd477ad269595657e9fc5d826e3d453fb83c9858bd76320a5a19e
Socks5Systemz
ac1ca9910b47c73f279ec42a5bbfc19424805f8dcbd8457d7ef32199219ff70d
Socks5Systemz
d05f38636d236314d40f22a27cddf777d00fb4fec5ee6d4fc569dba11e6f5861
Socks5Systemz
ef6aa89a4d4dc4db41b4406f984d0269c2ef9cf9856a7f04b7c938490202109b
Socks5Systemz
f4c455771c51a4cc207b7d4712e405a0d6474029541d2dbab07dc11f2bb39921
Socks5Systemz
+ 152 additional samples on MalwareBazaar
Result
Malware family:
socks5systemz
Create hunting rule
Score:
  10/10
Tags:
family:socks5systemz botnet discovery
Link:
https://tria.ge/reports/240731-ynnltsvfme/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Detect Socks5Systemz Payload
Socks5Systemz
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9596602d-8e09-4dc4-bee7-eb0eecc9dfda
Unpacked files
SH256 hash:
e06f027199c0026f45377800a675f9bdfb1310a4b08dc0b4f8f03d6084af1cb8
MD5 hash:
d676288a1b79e7331994522eae59a4ca
SHA1 hash:
699cdcc34c5fc8fe83e57a958d32cfc8aa9c475f
Detections:
Socks5Systemz
Create hunting rule
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
SH256 hash:
49844be53880ff0c512bc72cf63b3deb5d6e7183df597a89cd40dd8e813f7a99
MD5 hash:
6b0a52d2c90958b89ea296020b4f0e74
SHA1 hash:
1e5bf424f626b9965b4143dbe1ac9730b93485f7
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
SH256 hash:
08d2876741f4fd5edfae20054081cef03e41c458ab1c5bbf095a288fa93627fa
MD5 hash:
9e5ba8a0db2ae3a955bee397534d535d
SHA1 hash:
ef08ef5fac94f42c276e64765759f8bc71bf88cb
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
SH256 hash:
a168ec989cdc92f66f48d3b55cd2141b8cac0b77a305c7912b9589beb6a1deb3
MD5 hash:
1e6b9c4a5e2e42c328297b2dc4357b82
SHA1 hash:
7fefc6e961826bf674a033e54877ff736f10b485
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
SH256 hash:
99602e9b783eb68f67e25298fc0d06e04ad78d660faef2fae7e1a8d08c020b9b
MD5 hash:
85688fef06f88f256cdfb1729f927864
SHA1 hash:
0da10f178963fca2606b8ef2aca057c8d55bef83
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
SH256 hash:
258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b
MD5 hash:
3a8c9f010a87038a151bcee14aed51d5
SHA1 hash:
590e60bd792ead11cbd507c4de8ca9f77a3757a9
Link:
https://www.unpac.me/results/1cc5cf6d-9971-466d-bcc2-4d61c7cf175a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessA
advapi32.dll::OpenProcessToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetFileAttributesA
kernel32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account Informationadvapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments