MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452
SHA3-384 hash:	c22ac5dae8e6f41d3db3fda921fac505e133dc84c1a392f7fc3312bc226205dbec4b22608cd944b9f5d6f4ff50c53f6d
SHA1 hash:	09075bd6cac44167d792aca972ded9f918a57a3d
MD5 hash:	9b96cca0612f4a5d9f9c004b3d053e63
humanhash:	uranus-alabama-one-lion
File name:	SecuriteInfo.com.Trojan.Siggen22.38764.28306.17267
Download:	download sample
Signature	Socks5Systemz Alert Create hunting rule
File size:	7'335'412 bytes
First seen:	2023-12-16 16:19:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'564 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	196608:JAb4Ov/Hirx7Tc8WfIpevtyEDj88cnEhIkmZszj:Jhcirx7g4pq88aZszj
Threatray	6'886 similar samples on MalwareBazaar
TLSH	T1057633E1A220D4F2F81367B1582092500E353AC452F444CCB5FEAB9FDE7A48F9E56B57
TrID	76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe Socks5Systemz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

286

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468050/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen22.38764.28306.17267.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for the window

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Moving a file to the Program Files subdirectory

Modifying a system file

Creating a file

Creating a service

Sending a custom TCP request

Enabling autorun for a service

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/657dce366b1c246046f6ff99/reports/ea04f01a-9799-433e-9565-001f6e66165e/overview

Hybrid Analysis HEUR/AGEN.1332570

Verdict:

Suspicious

Labled as:

HEUR/AGEN.1332570

Link:

https://www.hybrid-analysis.com/sample/5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/bbee476f-2a0a-4613-a8f0-885068d7d09c

Joe Sandbox Petite Virus, Socks5Systemz

Result

Threat name:

Petite Virus, Socks5Systemz

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363440

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

PE file has nameless sections

Snort IDS alert for network traffic

Yara detected Petite Virus

Yara detected Socks5Systemz

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

75%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452/

ReversingLabs TitaniumCloud Win32.Dropper.Tnega

Threat name:

Win32.Dropper.Tnega

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 16:20:08 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

15 of 23 (65.22%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lqksxghfvrudhdsej7rnydw7npyx2xkfo6micxsabfinrs5gqrja._file

Threatray malicious

Verdict:

malicious

Similar samples:

095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011

Socks5Systemz

19aaa18d707ab1a3cb98c4a257c1cd8e8e2594b697aaffc2687539583810a653

Socks5Systemz

22a14d248853472bf27c94cc3b506b524673f5c52823b7e6bd470e067c34a3e9

Socks5Systemz

6de07b921c1697555b4ca043c5a1b8bd75356c92e23d6a472b30b46966476863

Socks5Systemz

82ffaa01c0b5847399e6e210f100d2559eeff6651fe0a70735c1ed3f0ecc1182

Socks5Systemz

99f303475707b9d778b855f038c8b8c42104c753bd5fa26c168b25a7e552a0f9

Socks5Systemz

aace929793e89d54fc77801417b9ebd301f51ab027f2b10475279b01aa48368c

Socks5Systemz

e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e

Socks5Systemz

+ 6'876 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/231216-ts3t4acbeq/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

UnpacMe INDICATOR_EXE_Packed_VMProtect

Unpacked files

SH256 hash:

860ce6b152a3e12ca0336d114c24a7c266aa0b16e033a1388a69d11c21777fb9

MD5 hash:

0edd953d13c6dabd5abcf327e5f28a56

SHA1 hash:

aa419577cbaf4a85102fcbc72ddaa3396a3398b5

Detections:

INDICATOR_EXE_Packed_VMProtect

Alert

Create hunting rule

Link:

https://www.unpac.me/results/17144333-c0a4-4730-9ffe-56a353947b55/

Parent samples :

e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e
aace929793e89d54fc77801417b9ebd301f51ab027f2b10475279b01aa48368c
19aaa18d707ab1a3cb98c4a257c1cd8e8e2594b697aaffc2687539583810a653
82ffaa01c0b5847399e6e210f100d2559eeff6651fe0a70735c1ed3f0ecc1182
6de07b921c1697555b4ca043c5a1b8bd75356c92e23d6a472b30b46966476863
99f303475707b9d778b855f038c8b8c42104c753bd5fa26c168b25a7e552a0f9
22a14d248853472bf27c94cc3b506b524673f5c52823b7e6bd470e067c34a3e9
095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011
5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

SH256 hash:

bfe1ab607dfba71517a995a31be6628c8673dc723660804fd30f374d3989359c

MD5 hash:

e82f019ab3c2e83c05abd197c7912003

SHA1 hash:

a705c9f56bc7d7d0c6591d23337d89fdbabce756

Link:

https://www.unpac.me/results/17144333-c0a4-4730-9ffe-56a353947b55/

SH256 hash:

110e7a8157e2cdc55f0b41b69c236bd0f91ba59f600022e09d545b2d7b441798

MD5 hash:

add6ce82e8bb545f5c97f4af6edada9e

SHA1 hash:

f744385a5af7d5b8e6ce7a58ceadc990d9f3d324

Link:

https://www.unpac.me/results/17144333-c0a4-4730-9ffe-56a353947b55/

SH256 hash:

17f2152345a2c165936cedbc6c7cb411a52ffd2939535a55b7758384bf19faf8

MD5 hash:

3268d38c741a1a4c167feb5156634f8e

SHA1 hash:

8f9084e3bf0dda70b43cdb59da868fdbd2252c83

Link:

https://www.unpac.me/results/17144333-c0a4-4730-9ffe-56a353947b55/

SH256 hash:

5ad03bcce667810efb47e4cf5304352cfd9041f0adef718628b92ae0251603af

MD5 hash:

f7f7a83179163c839b10983c2e807cbc

SHA1 hash:

2361e2d038aa30e1ab942972e393324978740354

Link:

https://www.unpac.me/results/17144333-c0a4-4730-9ffe-56a353947b55/

SH256 hash:

5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

MD5 hash:

9b96cca0612f4a5d9f9c004b3d053e63

SHA1 hash:

09075bd6cac44167d792aca972ded9f918a57a3d

Link:

https://www.unpac.me/results/17144333-c0a4-4730-9ffe-56a353947b55/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468050/