MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2
SHA3-384 hash: bd37aa9c5f388cb10a1db95c4225aef3c577ab749d33c4882c3220fa09ba1d68f04aaa42e76063efd4be35a495b56eea
SHA1 hash: d59cfff4649f29a5deefd23b5c13b7ae722b7278
MD5 hash: 59f09fe8964e63618cb478500dd0f402
humanhash: sink-august-iowa-robert
File name:SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.25358.14908
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:7'249'327 bytes
First seen:2023-12-11 12:42:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'507 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 196608:nb7GqE4R8pkjU+zNUxHf6TPPROF2piQzj:nb7GqEnczNUx/6b5OFqzj
Threatray 932 similar samples on MalwareBazaar
TLSH T1567633C5EEDF903AF3E7D973A67799001660AD15183422C3709E3EBB1E762D267017A2
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon fefce49e86c0fcfe (884 x Socks5Systemz, 259 x RaccoonStealer)
Reporter SecuriteInfoCom
Tags:exe Socks5Systemz

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/465057/
Detection(s):
SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.25358.14908.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Modifying a system file
Creating a file
Creating a service
Launching the process to interact with network services
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Searching for synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Enabling autorun for a service
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/657704703636548f374a5603/reports/5be19f32-b45c-4346-b847-19d84049685b/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/10feba4a-066a-4f31-bc9a-1415dde1579e
Result
Threat name:
Petite Virus, Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1358327
Signature
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1358327 Sample: SecuriteInfo.com.Heuristic.... Startdate: 11/12/2023 Architecture: WINDOWS Score: 100 58 time.windows.com 2->58 62 Snort IDS alert for network traffic 2->62 64 Antivirus / Scanner detection for submitted sample 2->64 66 Detected unpacking (changes PE section rights) 2->66 68 5 other signatures 2->68 9 SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.25358.14908.exe 2 2->9         started        12 svchost.exe 2->12         started        15 svchost.exe 1 2->15         started        17 7 other processes 2->17 signatures3 process4 dnsIp5 52 SecuriteInfo.com.H...570.25358.14908.tmp, PE32 9->52 dropped 20 SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.25358.14908.tmp 18 76 9->20         started        72 Changes security center settings (notifications, updates, antivirus, firewall) 12->72 24 MpCmdRun.exe 2 12->24         started        74 Query firmware table information (likely to detect VMs) 15->74 56 127.0.0.1 unknown unknown 17->56 file6 signatures7 process8 file9 44 C:\Program Files (x86)\...\wmaformat.exe, PE32 20->44 dropped 46 C:\Program Files (x86)\...\is-DMKNO.tmp, PE32 20->46 dropped 48 C:\Program Files (x86)\...\is-CO40T.tmp, PE32 20->48 dropped 50 56 other files (none is malicious) 20->50 dropped 70 Uses schtasks.exe or at.exe to add and modify task schedules 20->70 26 wmaformat.exe 1 15 20->26         started        29 net.exe 1 20->29         started        31 wmaformat.exe 1 2 20->31         started        34 schtasks.exe 1 20->34         started        36 conhost.exe 24->36         started        signatures10 process11 dnsIp12 60 ceeodyb.net 185.196.8.22, 49715, 80 SIMPLECARRER2IT Switzerland 26->60 38 conhost.exe 29->38         started        40 net1.exe 1 29->40         started        54 C:\ProgramData\KEStorage\KEStorage.exe, PE32 31->54 dropped 42 conhost.exe 34->42         started        file13 process14
Score:
10%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iztfxlw6otowlecqyps2534ef2qx6cfiextbntpihzelbkti4sza._file
Verdict:
malicious
Similar samples:
0bb73f4ff60a2917bd5ac2a9b56ed50631f4d9b8fb5c9dcaee5f46aa65eee596
Socks5Systemz
1ec5912dbff812e84d74e205ead4c61a116a7f46e28cb410e0d385626fe07bd4
Socks5Systemz
30c7986cdd7e736f818fded42c9a52e499a1314ff8ce111b911d1bcc07747bb2
Socks5Systemz
7a0d63c82699d06a025bd5f01623e2a4ce2e0b9222f143fed5ecff52d6681cbd
Socks5Systemz
a2d7523541fecdf6ca556f88ce59b6fd4cd23ec20d6dab99cc95c2c7e512c1a2
Socks5Systemz
ade717e96a94ac5cad02899a5cf0973706a5598ccc981a4c6973115b6b76b817
Socks5Systemz
cc421918dc547796353118db7e9454b93060fdf68e089293b7485132715d365d
Socks5Systemz
f1459e2d9ac520046fbc78425bc545342781a3056466664baace679c0c19c891
Socks5Systemz
f42bb0ea7e34b4b14b20252924b91c494cf8c45828f508350300b29fa1e63a3d
Socks5Systemz
f72986727e389f879d04be0151c3b3900e9913c7b73ee48eed01b1030cd5ebcb
Socks5Systemz
+ 922 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/231211-py2rrsgcc6/
Behaviour
Runs net.exe
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
fcffa6b65956801f75ee63c1352fb1d3a3f2621b0d6e34f27adaff9aa8ae48c9
MD5 hash:
f3be3fc36c65ecdeca599f6cf54bb873
SHA1 hash:
a1d77d2f485db4eb60fce646ee9b5cb5bb10da77
Link:
https://www.unpac.me/results/99ed3215-cb9b-4124-834a-bc285b2570ef/
SH256 hash:
fa6807655b4473a46b325b33f2df65338fe7b1d0d851d1a4b3b24075c9599a0b
MD5 hash:
39d183d0a80faf6c8851ece09f60432b
SHA1 hash:
9b646c03372b8ead74185c3b7103e48ddfc1d272
Link:
https://www.unpac.me/results/99ed3215-cb9b-4124-834a-bc285b2570ef/
SH256 hash:
8f6b12a8e092c39d0c0af4593f43f01d40f0dc3b47b18e7bce848225a29754a9
MD5 hash:
ca53650c36b51f77e4115e8042227da9
SHA1 hash:
fb95375bec18590a013ebe11608cd4f4011ff0ed
Link:
https://www.unpac.me/results/99ed3215-cb9b-4124-834a-bc285b2570ef/
SH256 hash:
936bfc8c6e6cad9010d9b50f562849894a659b9b0c5a3026b083dd651050bff3
MD5 hash:
4ac58c2eabaa3a2ee6a4f6e930276696
SHA1 hash:
e05f449d1ffefe0eb973502a1cebf6d267f78031
Link:
https://www.unpac.me/results/99ed3215-cb9b-4124-834a-bc285b2570ef/
SH256 hash:
46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2
MD5 hash:
59f09fe8964e63618cb478500dd0f402
SHA1 hash:
d59cfff4649f29a5deefd23b5c13b7ae722b7278
Link:
https://www.unpac.me/results/99ed3215-cb9b-4124-834a-bc285b2570ef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe 46665baede74dd659050c3e5aeef842ea17f08a825e616cde83e48b0aa68e4b2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2739355/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2739288/
Cape
Cape
https://www.capesandbox.com/analysis/465057/

Comments