MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 daa74b36d89c37396f2df487ad202f513ea6779793e7a3fc6243d33d8f82fbea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Socks5Systemz
Vendor detections: 13
| SHA256 hash: | daa74b36d89c37396f2df487ad202f513ea6779793e7a3fc6243d33d8f82fbea |
|---|---|
| SHA3-384 hash: | 616e79a3f811cd7af2fa53e0949b77a84ec7f68e5b2783ee6a88afc01ae27242ebd2314955cb701bcd31d8977c12dd82 |
| SHA1 hash: | 8f82b68359bc4e4e4a3d4f082d5d3825bebc1049 |
| MD5 hash: | 84beecea8a3b79b1a0993c5efe787ea8 |
| humanhash: | florida-seven-georgia-stairway |
| File name: | tuc4.exe |
| Download: | download sample |
| Signature | Socks5Systemz |
| File size: | 4'715'757 bytes |
| First seen: | 2024-01-05 18:22:59 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'462 x Socks5Systemz, 262 x RaccoonStealer) |
| ssdeep | 98304:Q9rs7Swve6EwRuh50lRkmNOz7bbd+2OKbZ7+KSkmVFWajbdl4dm8:wo16wOqE7OiCKSFWajRl4dD |
| Threatray | 11 similar samples on MalwareBazaar |
| TLSH | T1C82633BB8E615C71D10F5FB0A3B67F1867D27D256DB016A3678E19280F2B5E3604A38C |
| TrID | 54.5% (.EXE) Inno Setup installer (107240/4/30) 21.8% (.EXE) InstallShield setup (43053/19/16) 7.2% (.EXE) Win32 Executable Delphi generic (14182/79/4) 6.6% (.SCR) Windows screen saver (13097/50/3) 3.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  adm1n_usa32 |
| Tags: | exe Socks5Systemz |
Intelligence
File Origin
# of uploads :
1
# of downloads :
280
Origin country :
ROVendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Searching for synchronization primitives
Creating a file
Moving a recently created file
Launching the process to interact with network services
Modifying a system file
Creating a service
Launching a process
Enabling autorun for a service
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Argotronic GmbH
Verdict:
Suspicious
Result
Threat name:
Petite Virus, Socks5Systemz
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
Machine Learning detection for dropped file
PE file has nameless sections
Snort IDS alert for network traffic
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Score:
25%
Verdict:
Benign
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Malicious
First seen:
2024-01-05 18:24:07 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
12 of 23 (52.17%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 1 additional samples on MalwareBazaar
Result
Malware family:
socks5systemz
Score:
10/10
Tags:
family:socks5systemz botnet discovery
Behaviour
Runs net.exe
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Detect Socks5Systemz Payload
Socks5Systemz
Unpacked files
SH256 hash:
ea33397cf20161caf918edb0a16e4882d5e4470e0e6bc50ab67f876f2da34762
MD5 hash:
7f229b1a9bb4b650b46ed041a8009268
SHA1 hash:
c9c2d2dff8386a3ea2fc953fa9ca5eefd53531a5
SH256 hash:
ec2248113fe653785ae05b0a353a7f81d287ec1c872bc85cab5cc469995bde3b
MD5 hash:
847d4c0fe60ad8ef70b1cb6e440d1f7c
SHA1 hash:
539a4f02cac60db89640c8510f016e73e4fe6819
Detections:
INDICATOR_EXE_Packed_VMProtect
SH256 hash:
9340754ee8ff007b26f639235e61da5216e121a002f584db8348d085c50f2f26
MD5 hash:
a870a5946a387d41eae5f685554e3517
SHA1 hash:
f80499ee2415c6104df709530df10e91596e4d36
SH256 hash:
62d7c943fbfc43627dcccbdd11249126fda8369e02e5622475edfef2cf83156d
MD5 hash:
5647c8f2569de7986cc55b399f99d33b
SHA1 hash:
a98962b2e8566c2e21d4e800d4006e37bb5590f5
SH256 hash:
5ef880e75e4cde436865e47d84867ac2d323520792e2821efce18246c1237f61
MD5 hash:
5b88dafd18f137ec06bb72505a1d4111
SHA1 hash:
392be4c63ef993658961b37adc74212b76b2c78f
SH256 hash:
daa74b36d89c37396f2df487ad202f513ea6779793e7a3fc6243d33d8f82fbea
MD5 hash:
84beecea8a3b79b1a0993c5efe787ea8
SHA1 hash:
8f82b68359bc4e4e4a3d4f082d5d3825bebc1049
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_VMProtect |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with VMProtect. |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.