MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 881158cd16af17b390cf22fb6a87d1e3f23476418b670544365210ba9f63b47d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Socks5Systemz
Vendor detections: 9
| SHA256 hash: | 881158cd16af17b390cf22fb6a87d1e3f23476418b670544365210ba9f63b47d |
|---|---|
| SHA3-384 hash: | 295392a78ddf6cde8c06279ca02361d72c8414c1dff1234014c650708c45291d77b1e51620ad9e607fee85dabbf9b576 |
| SHA1 hash: | d33ef1487e7b7281ac4e70ffd3557d4bdd0b1761 |
| MD5 hash: | 93d60e50f2ee0e760c68835a1fbc11c0 |
| humanhash: | bakerloo-happy-helium-xray |
| File name: | SecuriteInfo.com.Trojan-Dropper.Win32.Agent.23848.5285 |
| Download: | download sample |
| Signature | Socks5Systemz |
| File size: | 4'791'590 bytes |
| First seen: | 2023-12-31 07:20:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'461 x Socks5Systemz, 262 x RaccoonStealer) |
| ssdeep | 98304:QiT4SqCrL8DDQ1ovb9lRkLB+saL9+mnl+3NO++aBFWzPZxIH4dm8:54SqCP3mlRkgJp+3D+arWzPPIH4dD |
| TLSH | T17A2633E3D6A25536E076A2300C93AC0562563323BC3D5A222F79155D4B33A6DC39BF9F |
| TrID | 76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe Socks5Systemz |
Intelligence
File Origin
# of uploads :
1
# of downloads :
275
Origin country :
FRVendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the process to interact with network services
Modifying a system file
Launching a process
Creating a file
Creating a service
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control installer lolbin masquerade overlay packed shell32
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Petite Virus, Socks5Systemz
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Score:
19%
Verdict:
Benign
File Type:
PE
Detection(s):
Malicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Runs net.exe
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
049b92fa244a80feb2c330d766563c6fe37fa64f622b72a0cf7e275060afa8d3
MD5 hash:
38c23b12fb2b3c102676a3cc3780e8e2
SHA1 hash:
3eb9312fd8430efc6582d296b6c9b0b04a12686d
Detections:
INDICATOR_EXE_Packed_VMProtect
SH256 hash:
ef63ee1ee6d320e3914c7e1559dbc6e6b4f800e2d858d1eb1005f7ff31922078
MD5 hash:
8249d7ced0ac7bc96257f50e49f42759
SHA1 hash:
23ba159c8608a6d6c25d53515cdf4fa7dbf06569
SH256 hash:
8286d199a3be1de1a3c208b1f35cfc9a1f69b82fd70e7941750f50d1fd9be5bd
MD5 hash:
d36c3493e40c710702756009acdedc69
SHA1 hash:
f9a4eccfa441690ba951658b522d2bc7bdf55941
SH256 hash:
d22cf0c4ad128f663aa02518ea07ffac54a098f354803b9b9aa689a8bf142ecc
MD5 hash:
860211d6591647eb51127db4ba8fe329
SHA1 hash:
5ec897cc2ef3c52e6f1738881f14d0bdaf356aa3
SH256 hash:
881158cd16af17b390cf22fb6a87d1e3f23476418b670544365210ba9f63b47d
MD5 hash:
93d60e50f2ee0e760c68835a1fbc11c0
SHA1 hash:
d33ef1487e7b7281ac4e70ffd3557d4bdd0b1761
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_VMProtect |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with VMProtect. |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.