MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e
SHA3-384 hash:	06193ad1edc6184ee6cadef2b6b3e59f235f793ce3fdc0fc1454eb9e55c8d66e927517b42e2736741fd900505bb3652f
SHA1 hash:	e8aed430211ea77458acffdf115a61d7112820fc
MD5 hash:	31f42f01a7f9cb4708be156eae8f5974
humanhash:	missouri-high-wisconsin-oscar
File name:	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.10987.28373
Download:	download sample
Signature	Socks5Systemz Alert Create hunting rule
File size:	7'335'412 bytes
First seen:	2023-12-16 09:16:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'564 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep	196608:UAb4Ov/Hirx7Tc8WfIpevtyEDj88cnEhIkmZszj:Uhcirx7g4pq88aZszj
Threatray	6'963 similar samples on MalwareBazaar
TLSH	T1C27633E1A220D4F2F81367B1582092500E353AC452F444CCB5FEAB9FDE7A48F9E56B57
TrID	76.2% (.EXE) Inno Setup installer (107240/4/30) 10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe Socks5Systemz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

277

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/467975/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Dropper.Win32.Agent.10987.28373.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for the window

Searching for synchronization primitives

Creating a file in the Program Files subdirectories

Moving a file to the Program Files subdirectory

Modifying a system file

Creating a file

Creating a service

Enabling autorun for a service

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/657d6b15b855eb3693dee993/reports/7ec3a173-10c7-4cc0-9a5d-5d0c79023f7c/overview

Hybrid Analysis HEUR/AGEN.1332570

Verdict:

Suspicious

Labled as:

HEUR/AGEN.1332570

Link:

https://www.hybrid-analysis.com/sample/e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d3321c36-0384-447f-99ba-0df248be5aa4

Joe Sandbox Petite Virus, Socks5Systemz

Result

Threat name:

Petite Virus, Socks5Systemz

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1363320

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

PE file has nameless sections

Snort IDS alert for network traffic

Yara detected Petite Virus

Yara detected Socks5Systemz

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

75%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 09:17:09 UTC

File Type:

PE (Exe)

Extracted files:

5

AV detection:

10 of 23 (43.48%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=47clqbms2x62urmyfefnsrmvvilst3r7egx5es2s3hvpfiqv2jpa._file

Threatray suspicious

Verdict:

suspicious

Similar samples:

0346b3f5bcb18dc9d6406ada3edf3f31acd99abbe72e214ac84c8b8b47bfc97d

Socks5Systemz

2969d17095a7eb6bf3b083a7a9a824d1470e9ae49f3a2601e55e46f84e08a51f

Socks5Systemz

53b6054838a9e7503580604b8c222d9b3bb80068ce98107864df9bd33f9df43c

Socks5Systemz

69e752639b68b97de52d8c1cde499be7fca51c8fe91fac9c0ae02be30d78f27a

Socks5Systemz

6a1edaddbee0de4f66de7a99c007baa8ba9ad297d3a7e0d750b8f27fe6154486

Socks5Systemz

7bb6037c523bd02645d27f2c0c1064208d46589bdce89a7e6539687aa70c5117

Socks5Systemz

92f99236d73d01014771b60c8ee4f23c8ae999c8a576ab1b9a0f4e894841722b

Socks5Systemz

a386c4dc920a0710b5c76d13d517660e07a1ef4a693b91a87318e8e27e8b1566

Socks5Systemz

dc65301b2065d587ca771f25bcaa129bc40dfef2294a54d5766075befe960079

Socks5Systemz

fef27f6e75c7b46bd160664e0c4d23454c41619b371c199d5c9341eac5eb020f

Socks5Systemz

+ 6'953 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/231216-k82sasceb7/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

UnpacMe INDICATOR_EXE_Packed_VMProtect

Unpacked files

SH256 hash:

860ce6b152a3e12ca0336d114c24a7c266aa0b16e033a1388a69d11c21777fb9

MD5 hash:

0edd953d13c6dabd5abcf327e5f28a56

SHA1 hash:

aa419577cbaf4a85102fcbc72ddaa3396a3398b5

Detections:

INDICATOR_EXE_Packed_VMProtect

Alert

Create hunting rule

Link:

https://www.unpac.me/results/4643576d-286f-4db0-be61-f9aec04ea7c1/

Parent samples :

e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e
aace929793e89d54fc77801417b9ebd301f51ab027f2b10475279b01aa48368c
19aaa18d707ab1a3cb98c4a257c1cd8e8e2594b697aaffc2687539583810a653
82ffaa01c0b5847399e6e210f100d2559eeff6651fe0a70735c1ed3f0ecc1182
6de07b921c1697555b4ca043c5a1b8bd75356c92e23d6a472b30b46966476863
99f303475707b9d778b855f038c8b8c42104c753bd5fa26c168b25a7e552a0f9
22a14d248853472bf27c94cc3b506b524673f5c52823b7e6bd470e067c34a3e9
095d7b0323e51f4021e79bcce8d6baeb38174389157fa8d4bc2aac62d4062011
5c152b98e5ac68338e444fe2dc0edf6bf17d5d457798815e400950d8cba68452

SH256 hash:

bfe1ab607dfba71517a995a31be6628c8673dc723660804fd30f374d3989359c

MD5 hash:

e82f019ab3c2e83c05abd197c7912003

SHA1 hash:

a705c9f56bc7d7d0c6591d23337d89fdbabce756

Link:

https://www.unpac.me/results/4643576d-286f-4db0-be61-f9aec04ea7c1/

SH256 hash:

672f46ff3db592b1b2124b0498a2b32520bd0eb5e784ece32a50d41b9f23a7b7

MD5 hash:

18a42d2c3eef38085057c607db739f02

SHA1 hash:

d95c35a2ed82f9569bcff58125fa365640d95796

Link:

https://www.unpac.me/results/4643576d-286f-4db0-be61-f9aec04ea7c1/

SH256 hash:

c432fab5c1779fe9416552d16139582150d45fa0ee1231daff32b32fd98738a0

MD5 hash:

3a9332527fc25068c4911b3a9d9089e6

SHA1 hash:

07032abe6c75ef587d8be715f8da549cd7bec325

Link:

https://www.unpac.me/results/4643576d-286f-4db0-be61-f9aec04ea7c1/

SH256 hash:

e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e

MD5 hash:

31f42f01a7f9cb4708be156eae8f5974

SHA1 hash:

e8aed430211ea77458acffdf115a61d7112820fc

Link:

https://www.unpac.me/results/4643576d-286f-4db0-be61-f9aec04ea7c1/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e7c4b80592d5fdaa4598290ad94595aa1729ee3f21afd24b52d9eaf2a215d25e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467975/