MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Socks5Systemz

Vendor detections: 14

Intelligence 14 IOCs YARA 3 File information Comments

SHA256 hash:	a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21
SHA3-384 hash:	9abb92cd8139ebbadae051fe2d86ad06be7a5594ddf3fa9c599678f5a781b9d068d20861490cdd57b69ff7db89670c7a
SHA1 hash:	fa5a6b76a9da8d082ab7f77c369e7231b9fddab4
MD5 hash:	39b8eb4957363bd161e13551c0b7dd0a
humanhash:	blue-fourteen-solar-four
File name:	file
Download:	download sample
Signature	Socks5Systemz Create hunting rule
File size:	2'090'210 bytes
First seen:	2024-03-07 18:51:44 UTC
Last seen:	2024-03-07 20:23:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'456 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	49152:C9fKScwB2e59US1S59OZcY+ffGhgspUzVOTQ2NtR5X:MLnB2eQTMYmozVm7
TLSH	T126A53336FF69C8BCD0A245746C2186741D2BBF143C7592D132ACE9CEAB37B916409B63
TrID	69.7% (.EXE) Inno Setup installer (107240/4/30) 9.2% (.EXE) Win32 Executable Delphi generic (14182/79/4) 8.5% (.SCR) Windows screen saver (13097/50/3) 4.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 2.9% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	Bitsight
Tags:	exe Socks5Systemz

Bitsight

url: http://root.newbond.su/data/pdf/june.exe

Intelligence

File Origin

# of uploads :

# of downloads :

336

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21.exe

Verdict:

Malicious activity

Analysis date:

2024-03-07 19:03:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b59b7870-1718-42f2-a603-8e2ce00c7d7d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Win32.Crypt.29729.13845.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for the window

Searching for synchronization primitives

Creating a file

Moving a recently created file

Modifying a system file

Creating a service

Enabling autorun for a service

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65ea0cd9fc3fe20efe62a48d/reports/08116b55-6eb1-4ed0-9072-77971ad48920/overview

Verdict:

Malicious

Labled as:

Win/grayware_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d2442203-83eb-49a3-8d0d-3582dbfe420a

Score:

66%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2024-03-07 18:52:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uvn6uulm5ae5bjvqlmersvk5dca2kult3fal73qrnicuepvu3mqq._file

Verdict:

malicious

Result

Malware family:

socks5systemz

Score:

10/10

Tags:

family:socks5systemz botnet discovery

Link:

https://tria.ge/reports/240307-xh22labh7y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Detect Socks5Systemz Payload

Socks5Systemz

Malware Config

C2 Extraction:

http://ckeumed.net/search/?q=67e28dd8680cf4794658a44a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978f571ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6e86fc16c5e690
http://ckeumed.net/search/?q=67e28dd8680cf4794658a44a7c27d78406abdd88be4b12eab517aa5c96bd86e893804b96148ab2865b77f80ebad9c30f7cb63037ed2ab423a4304383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689ff18c8ec929f32c8
http://aihugsy.ru/search/?q=67e28dd86f5af1211209a81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef619c3e8939a38

Unpacked files

SH256 hash:

7fc242f5bb605df14733ebb8b8e726bf59b7aa1c1eb1a3e8644e69bf2a94bf1b

MD5 hash:

8542c866ffd2c63929214d9b7dc8e3cd

SHA1 hash:

9cec3364fe1d11b62a9232507dd96a251940245e

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

SH256 hash:

9dd7a0aee5eb7e3f0b696440d6e49fd8b352ad4889a2c5c80700e77fe4ab567e

MD5 hash:

b810840c3e866bfa8c7976b9bcb0ea98

SHA1 hash:

de296cac5ce015e83c8462c6c182e13ef7399f2a

Detections:

INDICATOR_EXE_Packed_VMProtect

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

SH256 hash:

44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0

MD5 hash:

9c8886759e736d3f27674e0fff63d40a

SHA1 hash:

ceff6a7b106c3262d9e8496d2ab319821b100541

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

SH256 hash:

e4fc574a01b272c2d0aed0ec813f6d75212e2a15a5f5c417129dd65d69768f40

MD5 hash:

c8871efd8af2cf4d9d42d1ff8fadbf89

SHA1 hash:

d0eacd5322c036554d509c7566f0bcc7607209bd

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

SH256 hash:

47b68e896f74bb0ad1a46a1e4c250f4c0f57536842ce7a2033200c321b91c9ca

MD5 hash:

eba72ad1bba20d56d6eb2a3be282058a

SHA1 hash:

e85521e93f4ea7fd097f18c714103dceacb795ab

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

SH256 hash:

f45c6f9972d4c5f502e1add220dd3df49874ac91dab59467db0c1a06777ed85f

MD5 hash:

c5992281dd5a0d33a83bebe1aad9d2fb

SHA1 hash:

cbfbec8e0c97b4401d4be2f8adbde487f6700591

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

SH256 hash:

a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21

MD5 hash:

39b8eb4957363bd161e13551c0b7dd0a

SHA1 hash:

fa5a6b76a9da8d082ab7f77c369e7231b9fddab4

Link:

https://www.unpac.me/results/0bb26090-7551-4250-8de3-0d94659975d1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

exe a55bea516ce809d0a6b05b0919555d1881a55173d940bfee116a05423eb4db21

(this sample)

Dropped by

Privateloader

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2766920/

URLhaus

https://urlhaus.abuse.ch/url/2777500/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
SECURITY_BASE_API	Uses Security Base API	advapi32.dll::AdjustTokenPrivileges
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CreateProcessA advapi32.dll::OpenProcessToken kernel32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryA kernel32.dll::CreateFileA kernel32.dll::DeleteFileA kernel32.dll::GetWindowsDirectoryA kernel32.dll::GetFileAttributesA kernel32.dll::RemoveDirectoryA
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::LookupPrivilegeValueA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample