MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 18


Intelligence 18 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af
SHA3-384 hash: 287354512fa029657334f5061ff98fca4d19c270abd687bffff371f293c63cd86d9e6d88b0377af01af002f445fdb4f3
SHA1 hash: 3fa5fe9850582688b0f1b0a00d4bb88d029f48ad
MD5 hash: df752bee003d3d9ece03545bf66e7214
humanhash: september-berlin-don-carbon
File name:43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af.exe
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:3'796'734 bytes
First seen:2025-11-14 18:12:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'453 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 49152:C9QeP6oOKCRgImQ86H6Bq1AhNk/Wv2kDftNyysK6lxpWBUILDDiIdsvEAfGaajyw:MQypVZE6Baed3BxN5LPiIdsvEiGOWtwq
Threatray 67 similar samples on MalwareBazaar
TLSH T18D0633835F743962EEB3897918019F35548BEE09AC78883D30CE859D4F47FA66E27718
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter aachum
Tags:dropped-by-gcleaner exe Socks5Systemz


Avatar
iamaachum
Socks5Systemz C2: 178.16.53.192

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-11-12 21:44:06 UTC
Tags:
delphi auto generic gcleaner loader autoit lumma stealer inno installer stealc vidar
Link:
https://app.any.run/tasks/2543c79f-89bd-4c1f-bcc1-c9ac66fab73a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Socks5Systemz
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38234/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69177065434cd67b17c15542
Tags:
injection dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Searching for synchronization primitives
Creating a file
Moving a recently created file
Creating a service
DNS request
Connection attempt
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context borland_delphi fingerprint inno installer installer installer-heuristic overlay packed
Link:
https://www.filescan.io/uploads/691771098f2fc32a22dffd7c/reports/1d25d103-6518-4136-86fe-e5b41c4b86c2/overview
Verdict:
Malicious
Labled as:
Suspicious:InstallCore.XB.hwzw
Link:
https://www.hybrid-analysis.com/sample/43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-14T15:19:00Z UTC
Last seen:
2025-11-16T13:56:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Ekstak.sb HEUR:Backdoor.Win64.C2.gen HEUR:Backdoor.Win32.C2.gen BSS:Trojan.Win32.Generic Trojan-Proxy.Win32.Sok5Syz.sb Trojan-Proxy.Win32.Sok5Syz.wd PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e8a82031-1e8e-44fa-8e26-d4258021920e
Result
Threat name:
Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1814375
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
Score:
67%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af/
Verdict:
Malicious
Threat:
Family.SOCKS5SYSTEMZ
Link:
https://tip.neiki.dev/file/43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af
Threat name:
Win32.Trojan.Sockssystemz
Create hunting rule
Status:
Malicious
First seen:
2025-11-14 18:09:43 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ip65mozy3dflq22yqlpeirc5ey2ab62sktvb6ceku5xzeiwkrcxq._file
Verdict:
malicious
Label(s):
socks5systemz
Create hunting rule
coffeeloader
Create hunting rule
Similar samples:
051e3b65ed37e56bf45b35f53882802ec2688e4838a4f93dcf4678c91dc2b403
Socks5Systemz
0a74b5f15d7dd4802828c5a353b60437f0191957066008ecef940179ec0be520
Socks5Systemz
1cbfaff0a5800e95447a0e04e21edefc2aa9016d3177e285f7f99250703b3e35
Socks5Systemz
2467a15e01219fca80155df36a2f97be5457c59bdeb1ac1fff027174bd8db383
Socks5Systemz
44e86ff870563500e3162ebf3335d66ec3c89c4f3872cb591670d9c6a542c130
Socks5Systemz
c115a38aa9cca5625a4856827aa07cbac8d4fc461056afb15b444b7fd58becd9
Socks5Systemz
error
Socks5Systemz
fdaa42f9c1b55a008d4cf4a8f13ad1f96a9e00ebb235a21bf6d398cec488cbb1
Socks5Systemz
+ 57 additional samples on MalwareBazaar
Result
Malware family:
socks5systemz
Create hunting rule
Score:
  10/10
Tags:
family:socks5systemz botnet discovery
Link:
https://tria.ge/reports/251114-wtcemsvmbv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Detect Socks5Systemz Payload
Socks5Systemz
Socks5systemz family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4b543b7c-d61b-4d0e-9008-c0ee298d9475
Unpacked files
SH256 hash:
43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af
MD5 hash:
df752bee003d3d9ece03545bf66e7214
SHA1 hash:
3fa5fe9850582688b0f1b0a00d4bb88d029f48ad
Link:
https://www.unpac.me/results/367866cd-0b2a-4c94-b11c-952a1672a8ff/
SH256 hash:
471cf7dd5cdf8f516f49bf488ce4b81d1001d65cecaa86eb1ea0ae0ad719f187
MD5 hash:
1687daa5150dc60cf8cecd232a7fa965
SHA1 hash:
779a49be856872b16feec4d61b4a6a82051f7771
Link:
https://www.unpac.me/results/367866cd-0b2a-4c94-b11c-952a1672a8ff/
SH256 hash:
d75cb1c131fb3c18be6ad7f2c363284c32ad5933defcd6b57bac5342ab038edb
MD5 hash:
b61a1646c520b9c9d45d76732a30eda8
SHA1 hash:
bc3b25a4ef290007babb4d41da45e7bd77838673
Link:
https://www.unpac.me/results/367866cd-0b2a-4c94-b11c-952a1672a8ff/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/367866cd-0b2a-4c94-b11c-952a1672a8ff/
SH256 hash:
8aa5a805bf28e3940262d35ddc5be696096d8a1a09bb393e1e96be72fa0a8de0
MD5 hash:
1007b2eba3b8d91a2f6aa2bbdf47725a
SHA1 hash:
5da30e12f6b8c9decc302c3db625dc1be3c5bc7d
Link:
https://www.unpac.me/results/367866cd-0b2a-4c94-b11c-952a1672a8ff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ScanStringsInsocks5systemz
Create hunting rule
Author:Byambaa@pubcert.mn
Description:Scans presence of the found strings using the in-house brute force method
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe 43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af

(this sample)

  
Link
https://tria.ge/251114-wpx6jsvlhw/behavioral2
  
Dropped by
GCleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/38234/

Comments