MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5
SHA3-384 hash: c2d080597376582a70a149bfd1b245c1dc4e4c2d77f2ffd64b5c5a0148f3bfc0de69290c0157f0b689332c626c72c41b
SHA1 hash: 25aa3b16b604cd9e0c7aaa758047298259ff4c7b
MD5 hash: 05c23b1395272f342e8dc5771494f52d
humanhash: diet-carpet-twelve-maine
File name:SecuriteInfo.com.Trojan-Dropper.Win32.Agent.25072.2417
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:4'911'479 bytes
First seen:2023-12-30 23:24:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'455 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 98304:QnCkSOCsnRRIaQK304XqGMPA2PHldTOd/+W2NP+Zred53Mgak4dm8:bnsnsaQAXuDlEeked58xk4dD
Threatray 68 similar samples on MalwareBazaar
TLSH T18536338E86F4C176C270CF74C9766865AC53B8B55A241220B2DC8C9ECAB76CB6C17F47
TrID 58.3% (.EXE) Inno Setup installer (107240/4/30)
23.4% (.EXE) InstallShield setup (43053/19/16)
7.7% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe Socks5Systemz

Intelligence

File Origin
# of uploads :
1
# of downloads :
405
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan-Dropper.Win32.Agent.25072.2417.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Searching for synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the process to interact with network services
Modifying a system file
Creating a file
Creating a service
Launching a process
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin masquerade overlay packed shell32
Link:
https://www.filescan.io/uploads/6590a6d0ffafd83ebca0b4b0/reports/4eb77e2b-9be3-4ffb-911c-7211bb08a5ec/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Argotronic GmbH
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/429a0966-89df-452b-9a41-42070353fe75
Result
Threat name:
Petite Virus, Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1368308
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
PE file has nameless sections
Snort IDS alert for network traffic
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1368308 Sample: SecuriteInfo.com.Trojan-Dro... Startdate: 31/12/2023 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic 2->45 47 Antivirus / Scanner detection for submitted sample 2->47 49 Detected unpacking (changes PE section rights) 2->49 51 6 other signatures 2->51 9 SecuriteInfo.com.Trojan-Dropper.Win32.Agent.25072.2417.exe 2 2->9         started        process3 file4 31 SecuriteInfo.com.T...gent.25072.2417.tmp, PE32 9->31 dropped 12 SecuriteInfo.com.Trojan-Dropper.Win32.Agent.25072.2417.tmp 18 63 9->12         started        process5 file6 33 C:\Program Files (x86)\...\jsonstdapi.exe, PE32 12->33 dropped 35 C:\Program Files (x86)\...\is-2UUJV.tmp, PE32 12->35 dropped 37 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 12->37 dropped 39 83 other files (none is malicious) 12->39 dropped 15 jsonstdapi.exe 1 15 12->15         started        18 net.exe 1 12->18         started        20 jsonstdapi.exe 1 2 12->20         started        process7 dnsIp8 41 erxbrbs.ua 185.196.8.22, 49734, 49737, 49739 SIMPLECARRER2IT Switzerland 15->41 43 176.9.47.240, 2023, 49736, 49738 HETZNER-ASDE Germany 15->43 23 net1.exe 1 18->23         started        25 conhost.exe 18->25         started        29 C:\ProgramData\...\XBLNetconfig71.exe, PE32 20->29 dropped file9 process10 process11 27 conhost.exe 23->27         started       
Score:
18%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-12-30 23:25:13 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
14 of 23 (60.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yjo4rtprv7vryb4igu6esujurbyru4sjk3xfoxma3w3kse5u2g2q._file
Verdict:
malicious
Similar samples:
4632afaaca26e69491829d3b0572f3428b4c1c6bbaa290f988c8ed9860973367
Socks5Systemz
5dad68a8228450333b6202358c2fc50fe5ec7527c51e391c13354ab7ce27e667
Socks5Systemz
6349467ff9545e166e0f66de3e2b04e9528be1864bcea5b4c4dca9bc604d5e0a
Socks5Systemz
7157ecb7914f8782239cc0160a3cd6ff622e204651d957ac7846b4ad7e7d4343
Socks5Systemz
825cc69fcaba6cdd1afd55f938d7de491beca7365dfb34e071e613328fcddd98
Socks5Systemz
84267ef2e22d063f17aafa767f4f98f45de256ce765fee5d0fc4d5dd7f01ea58
Socks5Systemz
844e9cb99590b9d850dd755b821d1b92a14a02a6abd240451dad752cc930b315
Socks5Systemz
8fca1f9021a9ced5f64038dfd78e59a5aa1250758d1455064a752fd142da4a14
Socks5Systemz
f89be0ae5fef2d65bb44231da30bbcb64e0b2e01d46bfa29fc8c42a409e13876
Socks5Systemz
+ 58 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/231230-3d9tjaedf5/
Behaviour
Runs net.exe
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
aeaef1956435603ac214fe3ba2b86ae3a200c0baf7484a233aebf2931ab17c0b
MD5 hash:
07e25455f5260fe459e10676d4611ad5
SHA1 hash:
d66e4a6ec4ab646f333442565e6c580085254cc5
Link:
https://www.unpac.me/results/0b2914ba-3d7d-4e01-892c-d6d66d67afdf/
SH256 hash:
4cdf9686fd6f98c70d54dc0b8481f937888f852cbba89803218693af53b8d0af
MD5 hash:
4c29c80a9e0aa5f9d4a8ede768fb7190
SHA1 hash:
574f7cf59379e3c4afcf0041916f81efb4b3fc87
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/0b2914ba-3d7d-4e01-892c-d6d66d67afdf/
Parent samples :
844e9cb99590b9d850dd755b821d1b92a14a02a6abd240451dad752cc930b315
6349467ff9545e166e0f66de3e2b04e9528be1864bcea5b4c4dca9bc604d5e0a
03c4efb3900206eea4ce4850e38ae1b2dcd9837faa487eb0c8849bf5dc20b98d
c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5
67926c17aede849c4eaaf09eb88631c6dea6f9303a275ef3ad8d1c59f7b0f322
cd7f3e7bc9f55c0018b0db329c5fdaf13e2e295cf10eee13c8b580f47e871e1c
24556757732587ed3ac1c2e77866a7581dd5ee6e61d6c515f310752c47751920
954e838e8f5b220253b75049646ecc1354a18fc1815d2631676a5b3b640ae04e
a512ac9d8fccbaf44d52478ae2e544f27ce317fe895580534512451b6b386999
811341ecc410990e471254f7fb3cb7ee35ee2e973d27962348625812533e35eb
9c6485edb10d0150212a8fe11b97a472f86e881acc8249c7a686f14f3aa82b36
83eaf65e818f6596f8f3877812110afbc87719322590f589c1d459e057e469c8
b76c38f9b0503db183a96f06cdf97c1297752c91f7a0f62e60285b39e6c07e9c
f3827e0ae5a632a660d26a0551352b8e8332ae8097cfa76fcde8db7eaf7063fb
7a8854c8c29c00d77650a35a11b77cb471b04032bf22b02ab4dfdaba375e1544
2dc41322935b6a8560d895568f12a1b12b85506f5048868a5455204c818306e8
5ebac4ea7a4cf0ae9572f14dbab813c62272c3a2c8d85d846177e1e0fb794438
427ba60b57aaf0c74bb4c81fe38139ded7087a55f486d104554bea60ef9adbc7
ad84add303a674170d171ac6fa15068f68364bac20c8e9bb1ff4d43f46855a7c
3d7ea367f39fac4f0b7b8992f909dd54a423335ad384850d302a6367c6d52c04
3e71b12f758658108da7efa53051a57e72c39bf8e955e9dcbfde3ad55789927c
cdc42d582dcfc216e12fd59853ed4d26affbc1a5615d5a578872f674272dd80f
SH256 hash:
dcfaf8c6df573d12223e0fdfa31bb04cc95e722dc9de0d69a58492ba2d136f22
MD5 hash:
fd11d417ad04c2200e71384ba0d34bae
SHA1 hash:
91e01f483179158b8ceac96d30b620ca79d0adfd
Link:
https://www.unpac.me/results/0b2914ba-3d7d-4e01-892c-d6d66d67afdf/
SH256 hash:
32061fc5978115cd019bdbe91a8e1619c12e583fb188f43e016061bc8cda33ef
MD5 hash:
fe8235a0d3266a99a69c6ebf550da57c
SHA1 hash:
548c2cbda5516e758580323a3e73bc104e972a8e
Link:
https://www.unpac.me/results/0b2914ba-3d7d-4e01-892c-d6d66d67afdf/
SH256 hash:
50a5b5794265e58ffe045f32f9941d3c494e5895746f4c16e4ee258a1c1636b1
MD5 hash:
ca54d42870def4a20c0caa914be8fadd
SHA1 hash:
3fb28856ddc1115e91b7bed86902c57327d73a15
Link:
https://www.unpac.me/results/0b2914ba-3d7d-4e01-892c-d6d66d67afdf/
SH256 hash:
c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5
MD5 hash:
05c23b1395272f342e8dc5771494f52d
SHA1 hash:
25aa3b16b604cd9e0c7aaa758047298259ff4c7b
Link:
https://www.unpac.me/results/0b2914ba-3d7d-4e01-892c-d6d66d67afdf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe c25dc8cdf1afeb1c0788353c49513488711a724956ee575d80ddb6a913b4d1b5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2745343/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2741205/
  
URLhaus
https://urlhaus.abuse.ch/url/2741247/
  
URLhaus
https://urlhaus.abuse.ch/url/2741219/
  
URLhaus
https://urlhaus.abuse.ch/url/2741217/
  
URLhaus
https://urlhaus.abuse.ch/url/2741204/
  
URLhaus
https://urlhaus.abuse.ch/url/2745348/
  
URLhaus
https://urlhaus.abuse.ch/url/2745350/
  
URLhaus
https://urlhaus.abuse.ch/url/2739288/
  
URLhaus
https://urlhaus.abuse.ch/url/2739355/
  
URLhaus
https://urlhaus.abuse.ch/url/2741249/
  
URLhaus
https://urlhaus.abuse.ch/url/2745342/
  
URLhaus
https://urlhaus.abuse.ch/url/2741230/
  
URLhaus
https://urlhaus.abuse.ch/url/2745360/
  
URLhaus
https://urlhaus.abuse.ch/url/2745354/
  
URLhaus
https://urlhaus.abuse.ch/url/2745329/
  
URLhaus
https://urlhaus.abuse.ch/url/2745370/
  
URLhaus
https://urlhaus.abuse.ch/url/2741229/

Comments