MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d
SHA3-384 hash: 0eb284fe4af6509f96cc2ce4fa37c399c54caf44df2c2efe03bea4848bdb8dc4caf06cc301dc097b588d233c0e86bebb
SHA1 hash: c5be4e285c70ad8d62e790ff963528ba983cc6f9
MD5 hash: fe2236f55ce7c7b601e21932aab61b01
humanhash: nevada-six-purple-twelve
File name:file
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:3'874'556 bytes
First seen:2026-02-03 17:49:50 UTC
Last seen:2026-02-03 19:01:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'562 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 49152:C9WVnwZ7rcxkObQfeg+dfqZSPybhfVVYjOaDProYw/fJ4RqKxdr1lswnn9wYU1Jy:MWO7rcyOfEZuehwjRDDwux1AJUgWuw1
TLSH T14E063348A5D6EAF9E86611708567D0CA9C307A630D38674DF24D2DBEAF134C48346FBA
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter Bitsight
Tags:dropped-by-gcleaner exe f Socks5Systemz UNIQTWO.file


Avatar
Bitsight
url: http://195.178.136.38/service

Intelligence

File Origin
# of uploads :
3
# of downloads :
113
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8e2a0551-e44b-4ef7-9cc4-d2c81a0b83d8/
Malware family:
n/a
ID:
1
File name:
_d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d.exe
Verdict:
No threats detected
Analysis date:
2026-02-03 17:52:38 UTC
Tags:
inno installer delphi
Link:
https://app.any.run/tasks/d2eff15a-56f5-46fd-a281-35fa0e34e3a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Socks5Systemz
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51550/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6982355d87f81e55ffef0c8d
Tags:
injection dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Searching for synchronization primitives
Creating a file
Moving a recently created file
Creating a service
Enabling autorun for a service
Verdict:
Malicious
Labled as:
Suspicious:InstallCore.XB.hwzw
Link:
https://www.hybrid-analysis.com/sample/d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-03T14:58:00Z UTC
Last seen:
2026-02-03T17:08:00Z UTC
Hits:
~100
Detections:
Trojan-Proxy.Win32.Sok5Syz.sb Trojan.Win32.Ekstak.sb Trojan-Proxy.Win32.Sok5Syz.adi PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/41ae119c-f1f7-4885-adc5-2cfd8bec3e8b
Score:
70%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d/
Verdict:
Malicious
Threat:
Family.SOCKS5SYSTEMZ
Link:
https://tip.neiki.dev/file/d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uj4i4dim5wiwuurdqpwjhrvy52ibae4stj7tytwrjtqdqhse5wq._file
Verdict:
malicious
Label(s):
socks5systemz
Create hunting rule
Similar samples:
error
Socks5Systemz
Result
Malware family:
socks5systemz
Create hunting rule
Score:
  10/10
Tags:
family:socks5systemz botnet discovery installer
Link:
https://tria.ge/reports/260203-wep27abw4a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Detect Socks5Systemz Payload
Socks5Systemz
Socks5systemz family
Unpacked files
SH256 hash:
d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d
MD5 hash:
fe2236f55ce7c7b601e21932aab61b01
SHA1 hash:
c5be4e285c70ad8d62e790ff963528ba983cc6f9
Link:
https://www.unpac.me/results/0d496701-c1cd-4ec5-9bcb-683572d9e570/
SH256 hash:
82f08a71cebee565b27af3162c00145124d243f82eb4fa9ec564ebc8bc7c5ae1
MD5 hash:
bda7ac0f7d848b164b841bf67c3549fb
SHA1 hash:
4777b76a881e059780586edd963d473dcd180570
Link:
https://www.unpac.me/results/0d496701-c1cd-4ec5-9bcb-683572d9e570/
SH256 hash:
9dc1973f86c3eb466d209853d0677dfa5f536d81169dba4f1ed80fb75b965b18
MD5 hash:
3f971b5df9ad95ccd25f4d56c0c296cf
SHA1 hash:
d7216fc8f5ab7e8fcf667110f13c8f21017b8ec4
Link:
https://www.unpac.me/results/0d496701-c1cd-4ec5-9bcb-683572d9e570/
SH256 hash:
b20a8d88c550981137ed831f2015f5f11517aeb649c29642d9d61dea5ebc37d1
MD5 hash:
526426126ae5d326d0a24706c77d8c5c
SHA1 hash:
68baec323767c122f74a269d3aa6d49eb26903db
Link:
https://www.unpac.me/results/0d496701-c1cd-4ec5-9bcb-683572d9e570/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/0d496701-c1cd-4ec5-9bcb-683572d9e570/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ScanStringsInsocks5systemz
Create hunting rule
Author:Byambaa@pubcert.mn
Description:Scans presence of the found strings using the in-house brute force method
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/51550/

Comments