MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
SHA3-384 hash: 2c242062c5664ea81a82f52e0392493e9dba2f9b22d2463e71c57671f38c8f050b63116bc55561f2acfe6efbde6ea6c8
SHA1 hash: d7b4a641c0de7769e67bf243e93159376612d8f7
MD5 hash: edd03cb4870148c9f9c0a09749f70561
humanhash: muppet-hamper-twelve-oscar
File name:edd03cb4870148c9f9c0a09749f70561
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:7'054'359 bytes
First seen:2023-12-21 18:24:51 UTC
Last seen:2023-12-21 20:21:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'505 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 98304:p4bl3vfxBteThymDliVPPcm/HeX6WtEcPzInANypjjfZNlR1KDUPdOU/TENGWUwH:ah7teThPZidcKj8fPz6+4jb1KswNdDJF
Threatray 3'738 similar samples on MalwareBazaar
TLSH T1AA663392876B9A39C13BACB94720C36B41CE7B6F54FD6A23F99D32F9103F245A101365
TrID 76.2% (.EXE) Inno Setup installer (107240/4/30)
10.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe Socks5Systemz

Intelligence

File Origin
# of uploads :
2
# of downloads :
289
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c.zip
Verdict:
No threats detected
Analysis date:
2023-12-21 21:36:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fb0cb56b-2dea-4d2f-a56d-c1b61f8f8e9b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/468856/
Detection(s):
SecuriteInfo.com.Trojan.Siggen22.47135.18009.23534.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65848302d48681e0d663dd63/reports/040bad29-4581-44b8-b907-8dce526e987c/overview
Verdict:
Malicious
Labled as:
Agent.GCOX
Link:
https://www.hybrid-analysis.com/sample/ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0e819da4-000a-4d01-8fde-78ed898e1e06
Result
Threat name:
Petite Virus, Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1365744
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found API chain indicative of debugger detection
PE file has nameless sections
Snort IDS alert for network traffic
Yara detected Petite Virus
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1365744 Sample: 8fEEeAU91Y.exe Startdate: 21/12/2023 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 52 Detected unpacking (changes PE section rights) 2->52 54 6 other signatures 2->54 8 8fEEeAU91Y.exe 2 2->8         started        11 svchost.exe 3 14 2->11         started        13 svchost.exe 2 1 2->13         started        process3 file4 32 C:\Users\user\AppData\...\8fEEeAU91Y.tmp, PE32 8->32 dropped 15 8fEEeAU91Y.tmp 17 71 8->15         started        18 WerFault.exe 2 11->18         started        20 WerFault.exe 2 11->20         started        process5 file6 36 C:\Program Files (x86)\...\rbuttontray.exe, PE32 15->36 dropped 38 C:\Program Files (x86)\...\is-T33OL.tmp, PE32 15->38 dropped 40 C:\Program Files (x86)\...\is-OE0IV.tmp, PE32 15->40 dropped 42 99 other files (none is malicious) 15->42 dropped 22 rbuttontray.exe 1 15 15->22         started        25 rbuttontray.exe 1 2 15->25         started        process7 dnsIp8 44 aazhqtw.ru 185.196.8.22, 49714, 49716, 49718 SIMPLECARRER2IT Switzerland 22->44 46 95.216.227.177, 2023, 49715, 49717 HETZNER-ASDE Germany 22->46 34 C:\ProgramData\PDiskSnap76\PDiskSnap76.exe, PE32 25->34 dropped 28 WerFault.exe 22 16 25->28         started        30 WerFault.exe 2 16 25->30         started        file9 process10
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-12-21 18:25:07 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
3 of 37 (8.11%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5joupwgx7vp4qjunpnszaxexw3uq2g7dhlzl5cbmy5ck2v2asewa._file
Verdict:
malicious
Similar samples:
00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
Socks5Systemz
2d99fc04c07bcbb87ce1924199570c3a141183389adc60cd2b30571ab8122e16
Socks5Systemz
47faba85acbea0576e7006d53edc27352a95afb100fa60234e57b41d4a3d5cd7
Socks5Systemz
b4ecc5343955cdb23df3e6b83aced689ba863446522a70846db453e5ba0e89f8
Socks5Systemz
b68a7b8dd9c38abd30e56aa95f2ab80519b9d5fdbff1a726ed231891f04edae5
Socks5Systemz
c3d49b625f72eb6ce52ddbcfa28ddea1b0cbda77dab0df8cc13bd05a05414a49
Socks5Systemz
d7c0c7650124d5fc3ceb01652ae9b3f54898797bdb77733333b80be530f44814
Socks5Systemz
f95e2ed824d17844bbe1277cf764fbc769bcccd8d38cda03ca30f4c7b98eedbd
Socks5Systemz
+ 3'728 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/231221-w2lnaadhf3/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
1d2973a2f7875c8f4a1833276a7c7d2cd297b7da9cf5f2c8f79541016dbbcc90
MD5 hash:
c7890529841e1f3ab4da69d31d20a3b8
SHA1 hash:
d75d52cb54f30db348f915b8849badd757494c5d
Link:
https://www.unpac.me/results/8ef18661-26a4-41dd-a464-7a26806508bd/
SH256 hash:
ee1a3c1100dec8fd23709a7245944c8b65841810b37e2d90de9c3f45c0ac68cb
MD5 hash:
2dd87dbeca4a27b80fcf71e09fb953b7
SHA1 hash:
0183fccc631fd0ad12d1e711924c99d18a205b88
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/8ef18661-26a4-41dd-a464-7a26806508bd/
Parent samples :
f95e2ed824d17844bbe1277cf764fbc769bcccd8d38cda03ca30f4c7b98eedbd
f191ecdd2e5bfa3159591ed10b4b88437f56fbc917d817489372b7dd634b991b
2d99fc04c07bcbb87ce1924199570c3a141183389adc60cd2b30571ab8122e16
b4ecc5343955cdb23df3e6b83aced689ba863446522a70846db453e5ba0e89f8
b68a7b8dd9c38abd30e56aa95f2ab80519b9d5fdbff1a726ed231891f04edae5
8e8433d03b7a1a6c5bcd623ffb4a55014516e6afe0ee1974a9ab42da56326003
d7c0c7650124d5fc3ceb01652ae9b3f54898797bdb77733333b80be530f44814
47faba85acbea0576e7006d53edc27352a95afb100fa60234e57b41d4a3d5cd7
00ba60c535b204b6a18ebe2a27905d9ded150725d4a6a374ee8c4065d677a3e9
c3d49b625f72eb6ce52ddbcfa28ddea1b0cbda77dab0df8cc13bd05a05414a49
ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
af72d998606947486a87fd2c1dd93afa42154511ee5c4b220d3f1aa07426cd91
a080de20aa321af83e8570c5bf58f3f3644b043d807a3acabed4e546eb49a6c2
SH256 hash:
612c563f5f337ad9489bbf3c13ed3e6dae254b831087a065a3d123bf172c8474
MD5 hash:
266c26ac2f44b4defeb3e1e93f7e1157
SHA1 hash:
73e2109ae179cb10d08c84dc0b8d632986c8b4dc
Link:
https://www.unpac.me/results/8ef18661-26a4-41dd-a464-7a26806508bd/
SH256 hash:
d6a876a3c637d2547102e588b379481f4ad2e1c3bbe00cc62f9e5ce34f626538
MD5 hash:
2d2968adf62889a7df03f83bbecca239
SHA1 hash:
33c5cd888361e51d74e10fe0cd9dc38fd09e6ac2
Link:
https://www.unpac.me/results/8ef18661-26a4-41dd-a464-7a26806508bd/
SH256 hash:
d4f52b7d966c476dee40c677a9d9f224e55c592ee287660cd292e91eccd11848
MD5 hash:
9824254bb5cd741b93eec8e623580685
SHA1 hash:
0de975cd3955849f4c668eed5bb5f8b45f940d36
Link:
https://www.unpac.me/results/8ef18661-26a4-41dd-a464-7a26806508bd/
SH256 hash:
ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c
MD5 hash:
edd03cb4870148c9f9c0a09749f70561
SHA1 hash:
d7b4a641c0de7769e67bf243e93159376612d8f7
Link:
https://www.unpac.me/results/8ef18661-26a4-41dd-a464-7a26806508bd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe ea5d47d8d7fd5fc8268d7b65905c97b6e90d1be33af2be882cc744ad5740912c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468856/

Comments


Avatar
zbet commented on 2023-12-21 18:24:52 UTC

url : hxxp://zen.topteamlife.com/order/adobe.exe