MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672
SHA3-384 hash: d98e4efd7d8d31075bd37208e39a4d542fd53140473d417b912100becb3d99ba1a93ffc89371135019e114beed6ac165
SHA1 hash: ba13d9f73858686d5980f886abc6f43d7890e67c
MD5 hash: 051ba63dfb60b94a56a675d05f1c4987
humanhash: sad-kitten-dakota-music
File name:SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12771.18540
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:7'712'471 bytes
First seen:2023-12-09 08:21:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'507 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 196608:iM8p4DZgasJV7IH+Pe29nE5O7IdBHbNVKM7zj:iMH2asf7IHg9nQO7IPHbNVKKzj
Threatray 3'402 similar samples on MalwareBazaar
TLSH T1CC7633159F9C81F4C075E9B31CA64D83DAB1B982FD7B0C98A3A6509F692ABCD1D0C05F
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe Socks5Systemz

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/463929/
Detection(s):
SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12771.18540.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Searching for synchronization primitives
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching a process
Modifying a system file
Creating a file
Creating a service
Launching the process to interact with network services
Enabling autorun for a service
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/657423abda3178d99cde2f44/reports/0ca6a70f-5fea-4dcb-8e89-4b100ce1be6e/overview
Verdict:
Malicious
Labled as:
HEUR/AGEN.1332570
Link:
https://www.hybrid-analysis.com/sample/cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/dc4b2ea7-dcf7-4f54-b9ea-3c215818725e
Result
Threat name:
Petite Virus, Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1356827
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1356827 Sample: SecuriteInfo.com.Trojan-Dro... Startdate: 09/12/2023 Architecture: WINDOWS Score: 100 47 Snort IDS alert for network traffic 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for dropped file 2->51 53 9 other signatures 2->53 8 SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12771.18540.exe 2 2->8         started        process3 file4 33 SecuriteInfo.com.T...ent.12771.18540.tmp, PE32 8->33 dropped 11 SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12771.18540.tmp 17 76 8->11         started        process5 file6 35 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 11->35 dropped 37 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 11->37 dropped 39 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 11->39 dropped 41 56 other files (44 malicious) 11->41 dropped 55 Uses schtasks.exe or at.exe to add and modify task schedules 11->55 15 Voicemeeter.exe 1 15 11->15         started        18 Voicemeeter.exe 1 2 11->18         started        21 net.exe 1 11->21         started        23 schtasks.exe 1 11->23         started        signatures7 process8 dnsIp9 43 buencxd.com 185.196.8.22, 49734, 49737, 49739 SIMPLECARRER2IT Switzerland 15->43 45 95.216.227.177, 2023, 49735, 49738 HETZNER-ASDE Germany 15->45 31 C:\ProgramData\...\SHelperTrack.exe, PE32 18->31 dropped 25 conhost.exe 21->25         started        27 net1.exe 1 21->27         started        29 conhost.exe 23->29         started        file10 process11
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-12-09 08:22:06 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
13 of 23 (56.52%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwctexebnjctmt567ozpcx7eqg6kr7gwhc55qsuyf7m23qgrgzza._file
Verdict:
malicious
Similar samples:
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
Socks5Systemz
46e9abe7ac68378bb171f81629f4e36291c3889af69045179bbe2e1fee5d1a24
Socks5Systemz
637a8bc5f35435d88cf774b7a8cedff60748c719372875c868b20abe1d4f7ca6
Socks5Systemz
892dc1607407dedbb30f95ac92cb326a5c4f248f5e8981343bc84e4f834d8f52
Socks5Systemz
8a33f9a667819e943151870378158f3231fabf6d43067b63099920093ee165c1
Socks5Systemz
a1f46aa45e0bef5d47b20f44c9309a3b9b4d7aa585f693ed7b1dca3fbe75d699
Socks5Systemz
a37797b95ddba40a9451dbc5d92e0e641c7c95cc01e8d0c9adec2d392057a572
Socks5Systemz
d6e0cc68fa8dfa2c88e99869e277878e5889f083b8af884eea9c267abab47d7b
Socks5Systemz
+ 3'392 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/231209-j9kpqshaf6/
Behaviour
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
27397adf3aea86a5cec153df1433b0a4f470b087760105ae6272582311a51791
MD5 hash:
a76fe96f064d651ac1f7e6a979ebac6c
SHA1 hash:
fc7811aa34522f347c6dfc7ef6b06ba1714880d6
Link:
https://www.unpac.me/results/22ad8a9e-d3f1-4b39-93d3-fd80374b7006/
SH256 hash:
2ed193c763f271c1682530bbb262b9d7dc4e6b934e287da6c0f780bc4927782e
MD5 hash:
0a3ff0275e22fad274ce0a433c6840d1
SHA1 hash:
78fbebd0653ff6be8d5e1db30c05f9a20c01b362
Link:
https://www.unpac.me/results/22ad8a9e-d3f1-4b39-93d3-fd80374b7006/
SH256 hash:
74c7ef0d21748df5aa4be5f4479136cdd8d722a71114587edf1e041b3d8ccefe
MD5 hash:
ab79ef68155e5bde1f434e1311f3ff74
SHA1 hash:
843d5f1f1a751256f505f7a63090ddbeebd45192
Link:
https://www.unpac.me/results/22ad8a9e-d3f1-4b39-93d3-fd80374b7006/
SH256 hash:
cccaf9e80cd0093981fffde1d01ae412df184fb48c44cded93078838f37aa6f5
MD5 hash:
889692d8e4a25ed67c36aef918171fd8
SHA1 hash:
48c4cfdb03dd5ffe8edd77844fc8285a3a32fd0a
Link:
https://www.unpac.me/results/22ad8a9e-d3f1-4b39-93d3-fd80374b7006/
SH256 hash:
cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672
MD5 hash:
051ba63dfb60b94a56a675d05f1c4987
SHA1 hash:
ba13d9f73858686d5980f886abc6f43d7890e67c
Link:
https://www.unpac.me/results/22ad8a9e-d3f1-4b39-93d3-fd80374b7006/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd85325c816a45364fbefbb2f15fe481bca8fcd638bbd84a982fd9adc0d13672

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/463929/

Comments