MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91
SHA3-384 hash:	0e1dde4ab40b878a21d8756697bac8035677961d58e5d23675b682fd04d4e838e53fefcf4dadea216976b23d396ced11
SHA1 hash:	5989cd9674ca47e91fa21a19a551a085143fb2a3
MD5 hash:	1163335153de91c3e200672c566b0317
humanhash:	jupiter-snake-two-pip
File name:	SecuriteInfo.com.Trojan.Siggen22.39556.297.5166
Download:	download sample
Signature	Socks5Systemz Alert Create hunting rule
File size:	6'879'506 bytes
First seen:	2023-12-17 04:14:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'463 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	196608:UJt6sRO0e6O9qJ+jao1Ncz1RROoBqvL7UEF:Q6sRO09oHjdrc5RRO1jY+
Threatray	6'701 similar samples on MalwareBazaar
TLSH	T14F6633BFEDB94CB5C2E5993FCEB08465C3070AE118D5009C1ADC961CBE67F583225BA6
TrID	76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe Socks5Systemz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

280

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468125/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen22.39556.297.5166.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for the window

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Moving a file to the Program Files subdirectory

Modifying a system file

Creating a file

Creating a service

Sending a custom TCP request

Enabling autorun for a service

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/657e75c8a6bc59352f2aa333/reports/6da57d67-df0b-4449-9bb3-f29f8719aafa/overview

Hybrid Analysis HEUR/AGEN.1332570

Verdict:

Suspicious

Labled as:

HEUR/AGEN.1332570

Link:

https://www.hybrid-analysis.com/sample/59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/3456b0b1-e99e-4b1e-b5fa-271cf4c34cd1

Joe Sandbox Petite Virus, Socks5Systemz

Result

Threat name:

Petite Virus, Socks5Systemz

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363592

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

PE file has nameless sections

Snort IDS alert for network traffic

Yara detected Petite Virus

Yara detected Socks5Systemz

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-17 04:15:07 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

15 of 23 (65.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=leezzcsmsvtzmfqnhvfysky2d2op2g5jxqealbvjcogswfx6zkiq._file

Threatray suspicious

Verdict:

suspicious

Similar samples:

23bda1d8e92c34b73d2fd7cba0045363123b1ca703644e1272496020f48f0768

Socks5Systemz

41c26911be2b0a6de90a3b718748347aad4584d1f1d98b01c3caa1bb8e337d5c

Socks5Systemz

50deae409fb59a34e979ff03ca4275e42ee84244bc0c0ab9969fae5d7bbfb170

Socks5Systemz

599119c9efb698ce9ce8c82b2f26ce5890ac5c2154be16240598701e93221e9d

Socks5Systemz

62b2611c09d13ec267ac23f032ea5ea3c449599e45f0fb1dd6ea793f7cae1337

Socks5Systemz

6a1edaddbee0de4f66de7a99c007baa8ba9ad297d3a7e0d750b8f27fe6154486

Socks5Systemz

70d4763fe44cc63198b5cd53bc6ca94bf327b5590d1bfb1fc2703ad076c21bd7

Socks5Systemz

7bb6037c523bd02645d27f2c0c1064208d46589bdce89a7e6539687aa70c5117

Socks5Systemz

ce545b283c8bab1e754150d94d56048121b3632040b8cbc914341a68164d29f1

Socks5Systemz

faac17080796a33c4f3be0d50d3a51e07f7d383daac7394b6cfa7a46e94e83ba

Socks5Systemz

+ 6'691 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/231217-et8z6sdgdl/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

UnpacMe INDICATOR_EXE_Packed_VMProtect

Unpacked files

SH256 hash:

bfe1ab607dfba71517a995a31be6628c8673dc723660804fd30f374d3989359c

MD5 hash:

e82f019ab3c2e83c05abd197c7912003

SHA1 hash:

a705c9f56bc7d7d0c6591d23337d89fdbabce756

Link:

https://www.unpac.me/results/71f691ce-928a-4852-8ab5-18832b556bb4/

SH256 hash:

e5e4e5eec982c5486c9591a1df3f1c118761215b1c2760412122c916a8fd5d77

MD5 hash:

fa1d6a318e8819954e449bf30312a6f0

SHA1 hash:

00251cb7cd335354809cd41c0edb78920e9e3267

Detections:

INDICATOR_EXE_Packed_VMProtect

Alert

Create hunting rule

Link:

https://www.unpac.me/results/71f691ce-928a-4852-8ab5-18832b556bb4/

Parent samples :

59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91
faac17080796a33c4f3be0d50d3a51e07f7d383daac7394b6cfa7a46e94e83ba
50deae409fb59a34e979ff03ca4275e42ee84244bc0c0ab9969fae5d7bbfb170
599119c9efb698ce9ce8c82b2f26ce5890ac5c2154be16240598701e93221e9d
62b2611c09d13ec267ac23f032ea5ea3c449599e45f0fb1dd6ea793f7cae1337

SH256 hash:

ee6d01820ae2bd779e7e523884b53168c41a85e1a1296a7ef65e801b35234e59

MD5 hash:

2b9deb8ec994a55ff89dc0476ca8541f

SHA1 hash:

3dbc55486474c6b0b59c00ea724114df005f5e6e

Link:

https://www.unpac.me/results/71f691ce-928a-4852-8ab5-18832b556bb4/

SH256 hash:

d45c38ed241a4b25021ba4d2097d321007ab3f02009fa8697d6b23800c3d2f80

MD5 hash:

5dc4a038e54a41ca3caf3e1a217309a6

SHA1 hash:

0aa3a8adac11e4cab221f31f8f6f4e56cb942802

Link:

https://www.unpac.me/results/71f691ce-928a-4852-8ab5-18832b556bb4/

SH256 hash:

59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91

MD5 hash:

1163335153de91c3e200672c566b0317

SHA1 hash:

5989cd9674ca47e91fa21a19a551a085143fb2a3

Link:

https://www.unpac.me/results/71f691ce-928a-4852-8ab5-18832b556bb4/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/59099c8a4c956796160d3d4b892b1a1e9cfd1ba9bc080586a9138d2b16feca91

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468125/