MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54
SHA3-384 hash: af0d94f6145e77e53a0dacbdc4dd22477f12d7881b6af0927286cc25a57fb30266c2031882dd1bad20c9303b57849681
SHA1 hash: 48dda84e4f1042cca1cdc3747a5033fb28897177
MD5 hash: ba22528f4ee0e940a3072e216d1113e4
humanhash: summer-april-california-pizza
File name:tuc5.exe
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:4'573'799 bytes
First seen:2024-01-02 19:06:43 UTC
Last seen:2024-01-03 00:42:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'456 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 98304:QtrQv/c+SBacDCMBhwTUSCzk2qui5OrOrgLQxuskFvZBawmdc4dm8:CQv/cpBacOnUSCzBM6NxUdc4dD
Threatray 67 similar samples on MalwareBazaar
TLSH T102263342A014557AE171F6B38C44802FD0B7AEFD2E79420ABA6E4EDC6BBBC075550737
TrID 58.8% (.EXE) Inno Setup installer (107240/4/30)
22.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
7.7% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter adm1n_usa32
Tags:exe Socks5Systemz

Intelligence

File Origin
# of uploads :
2
# of downloads :
266
Origin country :
RO RO
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the process to interact with network services
Modifying a system file
Creating a file
Creating a service
Launching a process
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65945ef26b1c24604616dc33/reports/345d0c7e-6f8f-40bd-8c1a-32cfea29bd18/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Argotronic GmbH
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/78439233-9089-4d23-9314-bd2a05acb24f
Result
Threat name:
Petite Virus, Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1368955
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1368955 Sample: tuc5.exe Startdate: 02/01/2024 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 7 other signatures 2->48 8 tuc5.exe 2 2->8         started        process3 file4 28 C:\Users\user\AppData\Local\Temp\...\tuc5.tmp, PE32 8->28 dropped 11 tuc5.tmp 17 62 8->11         started        process5 file6 30 C:\Program Files (x86)\...\javafax.exe, PE32 11->30 dropped 32 C:\Program Files (x86)\...\is-GNU5Q.tmp, PE32 11->32 dropped 34 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 11->34 dropped 36 81 other files (none is malicious) 11->36 dropped 14 javafax.exe 1 15 11->14         started        17 net.exe 1 11->17         started        19 javafax.exe 1 2 11->19         started        process7 dnsIp8 38 ayankxe.ru 185.196.8.22, 49712, 49713, 49717 SIMPLECARRER2IT Switzerland 14->38 40 65.109.80.185, 2023, 49714, 49716 ALABANZA-BALTUS United States 14->40 22 conhost.exe 17->22         started        24 net1.exe 1 17->24         started        26 C:\...\Smart Design library 7.5.exe, PE32 19->26 dropped file9 process10
Score:
18%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-01-02 18:25:04 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
11 of 21 (52.38%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7nnqaekiucvspbge3mndzcitzdcnij5g47hjh6sgfbuuehb75ka._file
Verdict:
malicious
Similar samples:
06c0877edf7076f1d18b6d6a0dfe5e1a28e909cfbfb5868c36f5e0c7b4ad6082
Socks5Systemz
4632afaaca26e69491829d3b0572f3428b4c1c6bbaa290f988c8ed9860973367
Socks5Systemz
6fe8ab034a34587aadbae158e721c37a120f1e4fe3a106d74182a18e2c4270c4
Socks5Systemz
7157ecb7914f8782239cc0160a3cd6ff622e204651d957ac7846b4ad7e7d4343
Socks5Systemz
8fca1f9021a9ced5f64038dfd78e59a5aa1250758d1455064a752fd142da4a14
Socks5Systemz
9dd0d2bfb00da2ef8e4a59eba2916cb3208a352f667e7d550a2ba5d5434c4704
Socks5Systemz
ade5d725be0a886266fda7a680503eafc131c40f608d1c86cfbfffa5a6a88370
Socks5Systemz
e2b96622784705d2e1d7e7d117263a70b02fcd82c93f19dc8e5866a4bafbd1ad
Socks5Systemz
f89be0ae5fef2d65bb44231da30bbcb64e0b2e01d46bfa29fc8c42a409e13876
Socks5Systemz
+ 57 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/240102-3v5adabfgr/
Behaviour
Runs net.exe
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
32950675abdcae32306b38f79e3a1e1b351b576e98701fc23213529b8b948013
MD5 hash:
f15a6b475e7f2388d468f6b7bca15055
SHA1 hash:
eb8e4b0a482be78ace6d6f34608943e34b96e69a
Link:
https://www.unpac.me/results/10836839-ca6c-47fb-98a0-6de67d4ef813/
SH256 hash:
540c9216e5f3adc96588d6170a5a2c48a35de08260dff71140f67e2acd789e36
MD5 hash:
f2b644ad4a7273f0bff5f2f1b7b315ba
SHA1 hash:
30b892cc7a3f6ce1c806892e37b0e9d7deaedc81
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/10836839-ca6c-47fb-98a0-6de67d4ef813/
SH256 hash:
5d50dda3a863e03a58eebabe8a13ee393383c1446510fcd65d811df715f59549
MD5 hash:
2af86c36a8cbf49276da9e188994ea7e
SHA1 hash:
fc69c85bbf537fa2ac3795ebc8e0973cdd3b60a0
Link:
https://www.unpac.me/results/10836839-ca6c-47fb-98a0-6de67d4ef813/
SH256 hash:
323f555793af5bb8c5cae0e655fa2104c638c9bea480f52261ee2e0501476561
MD5 hash:
a4a65b014344fcce064412bc59ff6881
SHA1 hash:
9c35f49f2c6b11fe35d5428e5cef7cc4409b453c
Link:
https://www.unpac.me/results/10836839-ca6c-47fb-98a0-6de67d4ef813/
SH256 hash:
ba07f89c55db01734e9f2fb37273db4208e11a59ac6b848f231bccd6c57dd13d
MD5 hash:
dc72473c430f4681b300c36a705ded65
SHA1 hash:
5160d40b7b8763b037ab09d686a4dda80bbf5eb1
Link:
https://www.unpac.me/results/10836839-ca6c-47fb-98a0-6de67d4ef813/
SH256 hash:
47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54
MD5 hash:
ba22528f4ee0e940a3072e216d1113e4
SHA1 hash:
48dda84e4f1042cca1cdc3747a5033fb28897177
Link:
https://www.unpac.me/results/10836839-ca6c-47fb-98a0-6de67d4ef813/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe 47dad8008a4505593c2626d8d1e4489e4626a13d373e749fd231434a10e1ff54

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2739327/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2741246/
  
URLhaus
https://urlhaus.abuse.ch/url/2745331/
  
URLhaus
https://urlhaus.abuse.ch/url/2741248/
  
URLhaus
https://urlhaus.abuse.ch/url/2745374/
  
URLhaus
https://urlhaus.abuse.ch/url/2741232/
  
URLhaus
https://urlhaus.abuse.ch/url/2739285/
  
URLhaus
https://urlhaus.abuse.ch/url/2745346/
  
URLhaus
https://urlhaus.abuse.ch/url/2741251/
  
URLhaus
https://urlhaus.abuse.ch/url/2741223/
  
URLhaus
https://urlhaus.abuse.ch/url/2741227/
  
URLhaus
https://urlhaus.abuse.ch/url/2745368/
  
URLhaus
https://urlhaus.abuse.ch/url/2745338/
  
URLhaus
https://urlhaus.abuse.ch/url/2745358/
  
URLhaus
https://urlhaus.abuse.ch/url/2745327/
  
URLhaus
https://urlhaus.abuse.ch/url/2745351/

Comments