MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748
SHA3-384 hash: 936d9c10d094ba758351fb5c3c860d1a2ab609e585e5e4e9d24b68429f219caf4b91df3c57a38abc5a598527decc197e
SHA1 hash: 00a691955c3741b0759396954ba69643eb5cffb9
MD5 hash: ae46a312e5cad0c1a0a25eddfd4c72ef
humanhash: undress-foxtrot-steak-august
File name:ae46a312e5cad0c1a0a25eddfd4c72ef.exe
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:2'719'693 bytes
First seen:2024-02-28 07:25:25 UTC
Last seen:2024-02-28 09:33:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'457 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 49152:C97Z6OtHMAu3yK/+ev+DArvaxcdKSeYZb712jggadFv9kyprzsV5nIpu1:MV5eA0JWu+DCvaxGKXYhMNG1zzsV5n/
TLSH T116C5332A3B68E67CD30194744BF94728123BBE7C3C736462759C015EAFBB6A5940C3DA
TrID 69.7% (.EXE) Inno Setup installer (107240/4/30)
9.2% (.EXE) Win32 Executable Delphi generic (14182/79/4)
8.5% (.SCR) Windows screen saver (13097/50/3)
4.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.9% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter abuse_ch
Tags:exe Socks5Systemz


Avatar
abuse_ch
Socks5Systemz C2:
195.16.74.230:80

Intelligence

File Origin
# of uploads :
2
# of downloads :
346
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/478098/
Detection(s):
SecuriteInfo.com.FileRepMalware.21237.762.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65dee00a03a1c3a7aef7a2e8/reports/109499b7-13d9-4220-a278-d8cc4bbe501a/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d9306ca9-b543-4bbf-9348-9e1f5c49ab49
Result
Threat name:
Socks5Systemz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1400080
Signature
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Socks5Systemz
Behaviour
Behavior Graph:
Download SVG
Score:
21%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7scw4nqu4ioszu2vkbabvr6332t5uo7c7henpfrsb6aewbxck5ea._file
Verdict:
malicious
Result
Malware family:
socks5systemz
Create hunting rule
Score:
  10/10
Tags:
family:socks5systemz botnet discovery
Link:
https://tria.ge/reports/240228-h9hppsec56/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unexpected DNS network traffic destination
Detect Socks5Systemz Payload
Socks5Systemz
Malware Config
C2 Extraction:
http://dibspxp.info/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6e8fff14c2ec95
http://dibspxp.info/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86e99c8549885a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff811c9ee959f39ce6f
http://bwguyjo.com/search/?q=67e28dd86a5cf47e155fff1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef610c0ea97993a
http://bwguyjo.com/search/?q=67e28dd86a5cf47e155fff1a7c27d78406abdd88be4b12eab517aa5c96bd86ef90844d855a8bbc896c58e713bc90c91836b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ef9c9b3bc86d9517
Unpacked files
SH256 hash:
cb59e41f1dea37ace158943c9cec4ca72124f4d9afafadf6debe05984cf96ce6
MD5 hash:
5c1e64823274becfe67ee15d4a1cb19e
SHA1 hash:
79ead64a2c50d0e721e09a12d21a6c7b540dbfe9
Link:
https://www.unpac.me/results/53ba658f-dc3d-4d94-b4e6-1f78a940d299/
SH256 hash:
e710d3ef93c70702c366868db601f5bc01f854602c3b6ae7b63f07ac52501442
MD5 hash:
56ea7d51d94e15b8cdb2bc44813cdeac
SHA1 hash:
517df92e26afc91a248e8f8525482f15b6cfbe98
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/53ba658f-dc3d-4d94-b4e6-1f78a940d299/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/53ba658f-dc3d-4d94-b4e6-1f78a940d299/
SH256 hash:
9b68a3165db52d4323be45b181c86583fee3d633e91643cbc3ab449d30566fe9
MD5 hash:
951a69e0f3f9b4a2c4386fd8a6ff683f
SHA1 hash:
35b72900493d5e8f0ce8fdec90c0970897b29590
Link:
https://www.unpac.me/results/53ba658f-dc3d-4d94-b4e6-1f78a940d299/
SH256 hash:
94df0559fdb5b2128d9ae396230df01352a3af2889e5fb7f66050fbf5b9ea2cb
MD5 hash:
cba67cecc22d66efc9ece4bdd8a3f829
SHA1 hash:
0869ee15e3ad9df1d350137260d1851533fb26ae
Link:
https://www.unpac.me/results/53ba658f-dc3d-4d94-b4e6-1f78a940d299/
SH256 hash:
fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748
MD5 hash:
ae46a312e5cad0c1a0a25eddfd4c72ef
SHA1 hash:
00a691955c3741b0759396954ba69643eb5cffb9
Link:
https://www.unpac.me/results/53ba658f-dc3d-4d94-b4e6-1f78a940d299/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2770372/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2758623/
Cape
Cape
https://www.capesandbox.com/analysis/478098/

Comments