MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d
SHA3-384 hash: 73276277e9608660d9dac92d8e4c08896e911d3badf6e149473b2c3d123aa56629bb7470739ed9285919d7a2ed0010ae
SHA1 hash: c4468963f00ef44db4ecbacdf50abe0491b6d21a
MD5 hash: 31d984187d7ac703c8ff0719b03cc100
humanhash: fanta-alabama-utah-mountain
File name:server.exe
Download: download sample
File size:23'040 bytes
First seen:2022-01-20 15:36:34 UTC
Last seen:2022-01-20 18:04:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 20293b10112f971cfd5c0d157ef0eef1
ssdeep 384:5MZt/zyroeHj4ckTkTWvKEB4JIX6p4Jjxk/ZlFj7UWwoD21pE3nZ6I6:54zyMeHFqLB4JIqp4JUZD7UCspc8
Threatray 3 similar samples on MalwareBazaar
TLSH T104A2A57CA541159ED762C3F2D6AED311D57A352B023AE36FB3B853001F228E6DB50AC6
Reporter r3dbU7z
Tags:Coroxy exe hacktool

Intelligence

File Origin
# of uploads :
2
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/221151/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop19.14833.12449.19935.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a service
Launching a service
Creating a process from a recently created file
Searching for synchronization primitives
DNS request
Сreating synchronization primitives
Creating a window
Searching for the window
Enabling autorun for a service
Launching the process to change the firewall settings
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/4941/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware netsh.exe shell32.dll
Link:
https://www.filescan.io/uploads/61e981a4d32385db630f8a7f/reports/37bbe688-9bf0-46fd-bede-1ed37af619c4/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/924504
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Creates files in the system32 config directory
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses netsh to modify the Windows network and firewall settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 556983 Sample: server.exe Startdate: 20/01/2022 Architecture: WINDOWS Score: 88 35 Antivirus / Scanner detection for submitted sample 2->35 37 Multi AV Scanner detection for submitted file 2->37 7 server.exe 2 2->7         started        10 server.exe 4 2->10         started        14 svchost.exe 2->14         started        16 9 other processes 2->16 process3 dnsIp4 41 Antivirus detection for dropped file 7->41 43 Multi AV Scanner detection for dropped file 7->43 45 Uses netsh to modify the Windows network and firewall settings 7->45 47 Modifies the windows firewall 7->47 18 netsh.exe 3 7->18         started        33 127.0.0.1 unknown unknown 10->33 29 C:\backconnect\server.exe, PE32+ 10->29 dropped 31 C:\backconnect\server.exe:Zone.Identifier, ASCII 10->31 dropped 21 conhost.exe 10->21         started        49 Changes security center settings (notifications, updates, antivirus, firewall) 14->49 23 MpCmdRun.exe 1 14->23         started        file5 signatures6 process7 signatures8 39 Creates files in the system32 config directory 18->39 25 conhost.exe 18->25         started        27 conhost.exe 23->27         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d/
Threat name:
Win64.Trojan.Coroxy
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 15:16:19 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1956e3f16a36bff603caea89fd7a949759167ce47e5a0f7bf0a91696572752a2
ac2daf52daf244d7a7a41506422200b1fb352edf54ee32111ba90d6342ce0047
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/220120-s2g4baaed4/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Unpacked files
SH256 hash:
964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d
MD5 hash:
31d984187d7ac703c8ff0719b03cc100
SHA1 hash:
c4468963f00ef44db4ecbacdf50abe0491b6d21a
Link:
https://www.unpac.me/results/b580763f-96fd-420d-97c7-a6b557bf8b25/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/221151/

Comments


Avatar
◦ commented on 2022-01-20 15:39:35 UTC


install.txt ->

====================================================== RUSSIAN ======================================================

ВНИМАНИЕ! socks.exe стучит через 5 минут после запуска!

сервер имеет ограничение на число поддерживаемых socks5 соединений. не более 45151 соединений (порты 4000-49151)

1Gbit server / 1000 socks = 1 mbit per socks

windows:

1. установить IIS + PHP 7. инструкция на английском https://docs.microsoft.com/en-us/iis/application-frameworks/scenario-build-a-php-website-on-iis/configuring-step-1-install-iis-and-php

2. запустить server.exe. ставится только на серверные ос (windows 2003 server, windows 2008 server etc...) в обычных сборках винды стоит лимит на количество открытых соединений

linux:

1. установить apache + php 7

apt update
apt install apache2 -y
apt install php -y

2. загрузить и запустить server.out

chmod 777 server.out
./server.out &

если у вас centOS необходимо выключить фаерволл

# sudo systemctl stop iptables
# sudo systemctl disable iptables

/www устанавливаетс¤ в корневую директорию веб сервера
http://yourserver/systembc/password.php отображает текущие онлайн соксы (пароль adm443). дл¤ безопасности вы можете переименовать папку 'systembc'

socks.out - клиент

запускать так

chmod 777 socks.out
./socks.out &

====================================================== ФАСТФЛЮКС ======================================================

не рекомендуется использовать фастфлюкс. т.к. фф требует домен. более лучший вариант использовать ip заместо домена (домен часто блокируют)

для фастфлюкса требуются дополнительные настройки. пример конфига для haproxy

listen socks5_bc
bind *:4001 # (заменить на ваш порт в билдере)
mode tcp
option clitcpka
option srvtcpka
server target 31.184.196.228 send-proxy-v2

31.184.196.228 заменить на ip вашего серерва

+ необходимо выполнить 3 команды на сервере фастфлюкса (не путать с конечным сервером)

sysctl net.ipv4.tcp_keepalive_time=60
sysctl net.ipv4.tcp_keepalive_intvl=10
sysctl net.ipv4.tcp_keepalive_probes=3

иначе соксы будут отлетать каждую минуту

====================================================== ENGLISH ======================================================

ATTENTION! socks.exe come online after 5 minutes from start!

server have limit supporting connections. no more 45151 (ports 4000-49151)

1Gbit server / 1000 socks = 1 mbit per socks

windows:

1. install IIS + PHP 7. instruction here https://docs.microsoft.com/en-us/iis/application-frameworks/scenario-build-a-php-website-on-iis/configuring-step-1-install-iis-and-php

2. run server.exe. install only on server os (windows 2003 server, windows 2008 server etc...). not server os have limit connections

linux:

1. install apache + php 7

apt update
apt install apache2 -y
apt install php -y

2. upload and run server.out

chmod 777 server.out
./server.out &

if u are using CentOS need turn off firewall

# sudo systemctl stop iptables
# sudo systemctl disable iptables

/www need install to root folder of web server
http://yourserver/systembc/password.php show online sockses (pass adm443). for security u can rename folder 'sytembc'

socks.out - client

run commands

chmod 777 socks.out
./socks.out &

====================================================== FASTFLUX ======================================================

not recommended use fastflux. because ff need domain. more better use ip instead domain (domain can block)

for fastflux need additional settings. example config for haproxy

listen socks5_bc
bind *:4001 # (need to change with your port in builder)
mode tcp
option clitcpka
option srvtcpka
server target 31.184.196.228 send-proxy-v2

31.184.196.228 replace to ip of your server

+ need execute 3 commands on server of fastflux (not direct server. on ff)

sysctl net.ipv4.tcp_keepalive_time=60
sysctl net.ipv4.tcp_keepalive_intvl=10
sysctl net.ipv4.tcp_keepalive_probes=3

else sockses will disconnect every 1 minute