MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87
SHA3-384 hash:	5a11a17ceed90e457d0419ce1b5fa08ae11d97d8d5694df302909f1907440d943916a9e6ebe63836517c6dc3887037f1
SHA1 hash:	707a6feabb6d09abcb47c2a022e6c43de8f84966
MD5 hash:	2e0addfa6443976160cf94934db98a6a
humanhash:	nevada-mars-bluebird-autumn
File name:	SecuriteInfo.com.Trojan.Siggen22.39561.24718.10766
Download:	download sample
Signature	Socks5Systemz Alert Create hunting rule
File size:	6'898'128 bytes
First seen:	2023-12-17 04:14:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'457 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	196608:XLaimWcgIIX/433h0VxpqJX/sbR4zNwEOczF:ePwdP43qVxqUbR46En
Threatray	6'738 similar samples on MalwareBazaar
TLSH	T17766339B744163F9F200EF7E1B6B00984F67ABE20D55A09273740F5EA1BB8C67B09E15
TrID	76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe Socks5Systemz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

293

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468142/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen22.39561.24718.10766.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Moving a file to the Program Files subdirectory

Launching the process to interact with network services

Modifying a system file

Creating a file

Creating a service

Launching a process

Enabling autorun for a service

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/657e75df6b1c246046f7df37/reports/7f241cb3-6428-47d5-b2bb-11732fc6c9fd/overview

Hybrid Analysis HEUR/AGEN.1332570

Verdict:

Suspicious

Labled as:

HEUR/AGEN.1332570

Link:

https://www.hybrid-analysis.com/sample/59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f3a032c3-c696-41fe-9334-0ec7031f19c2

Joe Sandbox Petite Virus, Socks5Systemz

Result

Threat name:

Petite Virus, Socks5Systemz

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363575

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

PE file has nameless sections

Snort IDS alert for network traffic

Yara detected Petite Virus

Yara detected Socks5Systemz

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-17 04:15:19 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

15 of 23 (65.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lhonxzjkigj5sjylpxbbzxh5fiwizgwkvtkwd4ofgrenmu4zfsdq._file

Threatray suspicious

Verdict:

suspicious

Similar samples:

033100ad9863bd17ca8606c22dfb0abdfe616d94711801e6fddb764af7cec327

Socks5Systemz

229ddec0f4b92f9a1fbf56cf37346076d076f11dd1b307b43d81cb1147e463f8

Socks5Systemz

24b5814fe296ee57070beda6262af96dea7802a5462c0aed71f4ed45c3a5bccd

Socks5Systemz

3ee5c5a8fb884667eeca6c3299baa93f35852fdc27cec2a30e16a94345383e7f

Socks5Systemz

4f73de7b9df342b27fdfb1064390221a5476a0e4801d67aae041009fc149cf6b

Socks5Systemz

be7c8595cd546418bba8e844ba2f52a84381dac962b3bd14361ced4eac6350fb

Socks5Systemz

d8c23b426a74a6ad69665008bab562c0cf5069ebe459e16e30337f62e0108dad

Socks5Systemz

da847fa5ab9dcbe56ba271f272d2bbd99b1255fd607379193cffcf8fa1b2e825

Socks5Systemz

e001fa00ab86cbed17a9ab3330f376181eba1c2bc0bb6442b8cfdf67a566563f

Socks5Systemz

fff07b250a7512040a95c3ddb427b32d269bd4f7a2bece2ed878c2652a2b84a1

Socks5Systemz

+ 6'728 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/231217-evatrsfba9/

Behaviour

Runs net.exe

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Checks installed software on the system

Unexpected DNS network traffic destination

Executes dropped EXE

Loads dropped DLL

UnpacMe INDICATOR_EXE_Packed_VMProtect

Unpacked files

SH256 hash:

933bd39034ade0fd0091a8e87ea0f8e0be1ab6837edee0dd3bc4f72129fb8982

MD5 hash:

4233783cb6bea425bf5354b074595412

SHA1 hash:

4af987d755262bc5ee787ff78b70e3a24ed2b9e1

Detections:

INDICATOR_EXE_Packed_VMProtect

Alert

Create hunting rule

Link:

https://www.unpac.me/results/93a3a961-ae8c-4c26-8489-795806880f57/

Parent samples :

229ddec0f4b92f9a1fbf56cf37346076d076f11dd1b307b43d81cb1147e463f8
969c436d71ab3c1f9c2f1e84f2ea12def2223ff23e8ad2e8887c8bbe9895d944
715716f43becddcc83510df9b378e7e5d6e8a92dc230d4bf3b535a3be9c7045e
24b5814fe296ee57070beda6262af96dea7802a5462c0aed71f4ed45c3a5bccd
59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87
2e5f254e9c05713600953d6f863b276d5bf99436f797f83b96bba01c6dc347c9
a1f6707be04f5e2c5cba09631a4cd57778a75b9161669c60e04cb78d41851955
da847fa5ab9dcbe56ba271f272d2bbd99b1255fd607379193cffcf8fa1b2e825
841e572f6dfab3557590777213b776a9778b8fcdac8e0fe54be99a4594e4d651
53568c2fae94caa4431df88fd78ccdeb02a6b8b782404f67743d8fa1a90b894c

SH256 hash:

d1286da2332f03018f97ce332f9b3ea0963088e2ec105e6f2ba3acaea00560d4

MD5 hash:

5e46d295989c1e038ce5202a45a591b4

SHA1 hash:

46ea548a01d0e35d655a9cbcc90671fe3b5bf06c

Link:

https://www.unpac.me/results/93a3a961-ae8c-4c26-8489-795806880f57/

SH256 hash:

b7ac0de8f05545dc824126f94743ac7f11064c2aabbc58fe092334a236913d76

MD5 hash:

ed6bb0f7fc4e8adc60c1839617dc4f68

SHA1 hash:

46d9b9d293e2a276666b6c31a1c1260e1d9a5bf2

Link:

https://www.unpac.me/results/93a3a961-ae8c-4c26-8489-795806880f57/

SH256 hash:

d45c38ed241a4b25021ba4d2097d321007ab3f02009fa8697d6b23800c3d2f80

MD5 hash:

5dc4a038e54a41ca3caf3e1a217309a6

SHA1 hash:

0aa3a8adac11e4cab221f31f8f6f4e56cb942802

Link:

https://www.unpac.me/results/93a3a961-ae8c-4c26-8489-795806880f57/

SH256 hash:

59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87

MD5 hash:

2e0addfa6443976160cf94934db98a6a

SHA1 hash:

707a6feabb6d09abcb47c2a022e6c43de8f84966

Link:

https://www.unpac.me/results/93a3a961-ae8c-4c26-8489-795806880f57/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/59dcdbe52a4193d9270b7dc21cdcfd2a2c8c9acaacd561f1c53448d653992c87

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468142/