MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c
SHA3-384 hash: b190e32e95ce01dd542463cd26a29750c27ac3d927afffb9816cdc4892cd5f9ddefbff74f0a447fe4fd8adc4b40f7b07
SHA1 hash: 95be0248f53891aa5abecc498af5c3c98b532ba6
MD5 hash: f1d29fddb47e42d7dbf2cf42ba36cc72
humanhash: asparagus-pizza-pennsylvania-fix
File name:f1d29fddb47e42d7dbf2cf42ba36cc72
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:4'066'205 bytes
First seen:2024-04-18 20:51:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'505 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 98304:7aBtuktfhEkNB30u1j+CLCCM3/z2m44L1l0Tbkd:9kQlubbM3/fP1yHC
TLSH T1071633014E3BED7BC82155FB975F5122ADE17E32627E1010A1AE4A0C4B463AD8D79FCB
TrID 51.3% (.EXE) Win32 Executable PowerBASIC/Win 9.x (148303/79/28)
37.1% (.EXE) Inno Setup installer (107240/4/30)
4.9% (.EXE) Win32 Executable Delphi generic (14182/79/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.5% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe Socks5Systemz

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c.exe
Verdict:
Malicious activity
Analysis date:
2024-04-18 20:52:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a075fd75-f743-4d7c-91b2-008dfbfb83c5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Creating a file
Moving a recently created file
Modifying a system file
Creating a service
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint installer lolbin overlay packed packed shell32
Link:
https://www.filescan.io/uploads/662187f854bafb7d21d24bbc/reports/aa83160e-be37-4013-889d-81da4cd8488d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b9b810c3-f0da-43e5-8f3d-42d302f6e4ba
Result
Threat name:
Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1428422
Signature
Antivirus detection for dropped file
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
Score:
15%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-04-18 12:45:54 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
16 of 24 (66.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uucdd34fp5s6wv6uiggzc6zfgbzxdxjgclaelqgtj54m5jrrtfwa._file
Result
Malware family:
socks5systemz
Create hunting rule
Score:
  10/10
Tags:
family:socks5systemz botnet discovery
Link:
https://tria.ge/reports/240418-znqa4afg7z/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Detect Socks5Systemz Payload
Socks5Systemz
Malware Config
C2 Extraction:
http://bnqiocp.com/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c644db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a648af812c5e696
http://bnqiocp.com/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12eab517aa5c96bd86e99d844c835a8bbc896c58e713bc90c91836b5281fc235a925ed3e03d6bd974a95129070b617e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c3eb92993ec46c
Unpacked files
SH256 hash:
7ca4cb3221bdcdbe5b54ff7c8ddc413f4eeb8f0ec1088aa66085c5579ed0034f
MD5 hash:
9293076a55f8403fecfa1511002fc097
SHA1 hash:
78c69b0718d823e44884cd18ca30942e904ab4c6
Detections:
Socks5Systemz
Create hunting rule
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
Parent samples :
a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5
3242de97969e4b2826659a84e3c2b8be771ab96e7881d6574da016159f58494a
SH256 hash:
a62ec5eb49c825e1c4595f327cfdbb8e91a3bba4595b301e15d17b7f82664114
MD5 hash:
9dcc9a378c0619e32c83f0253d4a4279
SHA1 hash:
a5d19a4f2b6720289565d69e9668d824451807f1
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
SH256 hash:
17db74c713e0c12df74245243e7a63e75815e4f4d6fd9feca2d4d38041dd6ef0
MD5 hash:
054eed91b90c8066725331381c056a0b
SHA1 hash:
1a6ed65573f5f2e0664f32518b43b8b8cd7e14e0
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
SH256 hash:
0a6c41612400c3400466a0583dbb0e6c9bd310393704807e4f9617aa53abded6
MD5 hash:
42bf074b99a445614bd19c6e5724a01a
SHA1 hash:
a07123adbe7fa8bbd4a001332dc08aa6d3b5aec0
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
SH256 hash:
ebf6649ad638beed86892117b20f2a224c7dd8d62b4e7720ebf8f360794e190f
MD5 hash:
e1ea7491d3b8ce4fa148dce7444c0d31
SHA1 hash:
6f9f59034bdee930c4207b4088bdc2698c774869
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
SH256 hash:
d73989616a130a4c5ddd72bd5819fd87af0c1d001f2c22246a336f0b9cd1a0b8
MD5 hash:
d35f3a4ac64b30075503ee8bd6f97dbe
SHA1 hash:
0a4142e30ebc11677be73109ceb5db861cfd9466
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
SH256 hash:
a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c
MD5 hash:
f1d29fddb47e42d7dbf2cf42ba36cc72
SHA1 hash:
95be0248f53891aa5abecc498af5c3c98b532ba6
Link:
https://www.unpac.me/results/8347cd3b-2748-49a6-8ffe-07fc53030c53/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2817456/
  
URLhaus
https://urlhaus.abuse.ch/url/2817869/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessA
advapi32.dll::OpenProcessToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetFileAttributesA
kernel32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account Informationadvapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments


Avatar
zbet commented on 2024-04-18 20:51:35 UTC

url : hxxps://power.crazyfigs.top/style/070.exe