MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Socks5Systemz

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2
SHA3-384 hash:	51dc18ddefe0523a26e2dd51e65fe5e819dbedaf99d95d545330543c6b730034d57cb31b6edbccd5d712f8a35af516a8
SHA1 hash:	e422aec0d328480a4de087d57eb4c4ff5d4aba5e
MD5 hash:	ded765bc5ba4afdd70cdca87b06e031f
humanhash:	potato-east-football-texas
File name:	ded765bc5ba4afdd70cdca87b06e031f.exe
Download:	download sample
Signature	Socks5Systemz Create hunting rule
File size:	2'129'589 bytes
First seen:	2024-03-23 12:30:23 UTC
Last seen:	2024-03-23 14:38:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'456 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	49152:32qrMGcmhsZWMZA9wvRXHURUwDbNVrhs2zFb+Z90se7D:m6V0WMZXXiFbjrhs21w9bc
Threatray	20 similar samples on MalwareBazaar
TLSH	T1DEA53306EFE70C39EA61FBBCCD09D1288A237DA67A390069331D6E8D7B479549E01753
TrID	76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Socks5Systemz

abuse_ch

Socks5Systemz C2:
45.142.214.240:80

Intelligence

File Origin

# of uploads :

# of downloads :

289

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2.exe

Verdict:

Malicious activity

Analysis date:

2024-03-23 12:32:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/69d32865-8773-4c83-a583-7cefd33d4c9a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for the window

Creating a file

Moving a recently created file

Modifying a system file

Creating a service

Enabling autorun for a service

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65fecb88b81a555db48bf769/reports/72f21ce3-393e-4983-81e0-e12820644b03/overview

Verdict:

Suspicious

Labled as:

HEUR/AGEN.1372994

Link:

https://www.hybrid-analysis.com/sample/5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a12e3b5c-ae44-4576-aead-d795af6ccf62

Score:

14%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-03-23 12:31:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

11 of 24 (45.83%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lvlmt6c4ve3uv3s7w6sp33bludkbci5dtv2igzazwqgtlrxst3ra._file

Verdict:

malicious

Socks5Systemz

5066ac412c958ec0cc10a69dd658dcd6d1ddfa484f2810aed7d9d69d075992a4

Socks5Systemz

9e4ab69d21a49fc7f4b7351605fe7a886a6592e675b84f9883cee94272ca0cbc

Socks5Systemz

c23242b32c4bc6e3ed2fa667c90c953ea830e4078772b8782ece98781748a260

Socks5Systemz

+ 10 additional samples on MalwareBazaar

Result

Malware family:

socks5systemz

Score:

10/10

Tags:

family:socks5systemz botnet discovery

Link:

https://tria.ge/reports/240323-pp2emsaf9s/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Detect Socks5Systemz Payload

Socks5Systemz

Malware Config

C2 Extraction:

http://bexjfoq.com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a668ff616c1ec95
http://bexjfoq.com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12eab517aa5c96bd86ee9d8145815a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c1ee9c9d3ace6f
http://boeayee.com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe10c9e8949932

Unpacked files

SH256 hash:

590beff18e862e27b2fb92dd65170297c6e6646c960cf6e742dcb8a0fa8c7988

MD5 hash:

e2996dff751f9eb7ed4bd1c4d86b33d6

SHA1 hash:

ed3a1dd17478d510619dcbe01cc138cdd02e3103

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

SH256 hash:

c894f1f29529d95f72a1815d1ec64f5ed8a66a80e40636d7339538f91a70638a

MD5 hash:

f17afe6de4e34ffd377233873334fc51

SHA1 hash:

1b0041360f49a7686bc86912d2bf3296c568b6e2

Detections:

Socks5Systemz

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

Parent samples :

35ada52de8f891048be294d022690330246340af488c513b779cba2e4b829cc1
c23242b32c4bc6e3ed2fa667c90c953ea830e4078772b8782ece98781748a260
5066ac412c958ec0cc10a69dd658dcd6d1ddfa484f2810aed7d9d69d075992a4
9e4ab69d21a49fc7f4b7351605fe7a886a6592e675b84f9883cee94272ca0cbc
a7a7a60fa640fc9a4dbdbac52b68a1774bb159b99c179df650c9f41fd4d20a6a
ee094b47e9e3bb7ba12d171bce953b0511b9fa3c8e5deb3d2662078bc72ad9c4
6e8879c7cf7985de7664ac3d756fce01503d9d18fdef1bfdafd568a4cecde171
5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2
cf2c71d279310105bce28d8ca6f90a42733da306d07e2c13acaa1cc90ff8b8be
ac9c83755d42aa96f1654229b594fa401113a79222b9deef71a1d4f18a5e8fc1
92d1895c792c289e89a3ef19f00a1061e6928fed385b71358f0c407066939269
4d79b7d721263bd35ec4d7bf5af5a694d7e3ddb0b10b607a6b9e0f1b75d00b55
6e08ed3b9a5575b1eb4501fa28a9b0fa9f022dbd459de13d6a164f67418ad0c5
fb222ebb6c799f2bd4150c93a45cac3fe803d63cdb21c5eed605de253b22f088
7f9ca27e76d60ddb6e159becb582b1fe2f449a6b55293d95321bf42766a2783c
263131f2d2b4637ee410f735904d1e8fd13f2ef6c6ef9eaa842dac2afe1b7e5f
6d91c3bdc4c0d1a6001d34a62ad14fc497b44189aff21f5b63b4bb3d9dc360cd
19f878573535fd072225a06e5fc283bc9925a79df1b795c25d6a01605966b4c5
fead6561e50724038c49722adf75aacdf73f8f0793c3f76f0bc64fdc34f9017f
397827014487dda261c8ccce64d247821a6d096384f0dee3e2700bda35ce0728
6243e73fcf75709917694b16bde39e15af7138768b7dcb49d43fb91177ebc16c
e604beaf6d3c8bddc0c664babf465e6210f53fdf1745ad8173a34bec3d35cb11
acf1a8ba6e2046871a9aee94d88264ec9e40906beace50132592996bba3b7947
3caf20651766fe9fdcc804393c554152365e2e10fe62db7afb11259be2888247
e81ff10966ada26913f189bc92bef2953e4c0b03ce3b15bf22c464bf16b957cf
70f309f1618f31a178edd083faf5353a73fe55c2ee0e66b620e7c69da8644469
f628b63f5984e44746bbfa5cc79d2a8fc61e366178bf7cf7ac9d454714f42886
d4f3105bcebf610478999b176161bf7e3570da00d26c9cb7e2bb2c9159198a72
a135cea5f1d9cb26950827efe07dabcf2f9335565c04ab99fb761e3e975c97e1
3e0363040c56dba553995e51960c257af7b5685f2932d5a1bdf8e6652a80fd40

SH256 hash:

6bcb33ab051d790ada004724a632163d3f75c6a6e6ec1173a76acfaa157628d0

MD5 hash:

c3e0a7b611f039e08fae5b289f79ca22

SHA1 hash:

29d3665f109c3418b7d74ae5fcab33ef189ced62

Detections:

INDICATOR_EXE_Packed_VMProtect

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

SH256 hash:

44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0

MD5 hash:

9c8886759e736d3f27674e0fff63d40a

SHA1 hash:

ceff6a7b106c3262d9e8496d2ab319821b100541

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

SH256 hash:

4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2

MD5 hash:

0ee914c6f0bb93996c75941e1ad629c6

SHA1 hash:

12e2cb05506ee3e82046c41510f39a258a5e5549

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

SH256 hash:

acfeaebf68deb22c621ad93d3d79098ebcac9a84f7bfa50cc9cec0c548352201

MD5 hash:

276bd5144cb32a622837e024b2a02364

SHA1 hash:

7765b0196ed20284729c1466d1029f2957e871b3

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

SH256 hash:

5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2

MD5 hash:

ded765bc5ba4afdd70cdca87b06e031f

SHA1 hash:

e422aec0d328480a4de087d57eb4c4ff5d4aba5e

Link:

https://www.unpac.me/results/f07f4916-e39f-48bf-8f49-20ff03edb611/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Socks5 Systemz

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

exe 5d56c9f85ca9374aee5fb7a4fdec2ba0d41123a39d74836419b40d35c6f29ee2

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2786369/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2766920/

URLhaus

https://urlhaus.abuse.ch/url/2777500/

URLhaus

https://urlhaus.abuse.ch/url/2787067/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
SECURITY_BASE_API	Uses Security Base API	advapi32.dll::AdjustTokenPrivileges
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CreateProcessA advapi32.dll::OpenProcessToken kernel32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryA kernel32.dll::CreateFileA kernel32.dll::DeleteFileA kernel32.dll::GetWindowsDirectoryA kernel32.dll::GetFileAttributesA kernel32.dll::RemoveDirectoryA
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::LookupPrivilegeValueA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample