socks5systemz | file[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
file.dll
Size 623KB
Sample240401-1lf53sga3t
SHA256 63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15
MD5 8e3161bdec7310b024db91255398f39e
SHA1 12c65adfa60de424dbf2aa0a1cc6fba9b25063bd
SHA512 b70946035c50674ebf1503c1f8de95952f1e9c7d7fcce6e85ef43195fb4f65e9347fae4ee3a05d30af99e4b68254852056ff2c7aa12123f70b3ff6cf48b78e40
SSDEEP 12288:2jsgiZdvAeRw3+aXHv50cCleBqq2cvpzwnAmvRKLiTOkkRpZHD0kmiIjcBDfg5En:ksgwdvAOMP50cCleBqqzvp0nAmvR+iTs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
sample	family_socks5systemz

Socks5systemz family
socks5systemz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.dll

File Explorer

file.dll

.dll 623KB

file.dll

IMPHASH 99f735f47b2cd370c9d9f10c289154e0
SHA256 63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15
MD5 8e3161bdec7310b024db91255398f39e
SHA1 12c65adfa60de424dbf2aa0a1cc6fba9b25063bd
SHA512 b70946035c50674ebf1503c1f8de95952f1e9c7d7fcce6e85ef43195fb4f65e9347fae4ee3a05d30af99e4b68254852056ff2c7aa12123f70b3ff6cf48b78e40
SSDEEP 12288:2jsgiZdvAeRw3+aXHv50cCleBqq2cvpzwnAmvRKLiTOkkRpZHD0kmiIjcBDfg5En:ksgwdvAOMP50cCleBqqzvp0nAmvR+iTs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Socks5Systemz Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetCloseHandle InternetOpenA InternetSetOptionA InternetReadFile InternetOpenUrlA

dnsapi

DnsFree DnsQuery_A

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW VirtualQuery CreateFileA lstrlenA TlsGetValue SetWaitableTimer InterlockedIncrement GetQueuedCompletionStatus InterlockedDecrement QueryPerformanceCounter InterlockedCompareExchange SleepEx WriteFile InitializeCriticalSection TlsSetValue TerminateThread InitializeCriticalSectionAndSpinCount GetTickCount GetProcessHeap HeapAlloc CreateEventA GetCurrentProcess HeapFree WaitForSingleObject SetEvent Sleep GetSystemTimeAsFileTime LeaveCriticalSection ReadFile lstrcatA InterlockedExchange GetLastError SetLastError GetProcAddress QueueUserAPC EnterCriticalSection InterlockedExchangeAdd LocalAlloc PostQueuedCompletionStatus WaitForMultipleObjects GetModuleFileNameA CreateIoCompletionPort GetModuleHandleA DeleteCriticalSection GetVersionExA TlsAlloc CloseHandle CreateWaitableTimerA LocalFree TlsFree DeleteFileA CreateThread FreeLibrary LoadLibraryA DeviceIoControl HeapSize GetModuleHandleW GetModuleFileNameW SetEndOfFile CreateFileW ReadConsoleW FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc OutputDebugStringW SetFilePointerEx LCMapStringW GetStdHandle GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType GetConsoleMode GetConsoleCP FormatMessageA OpenEventA ReleaseSemaphore GetCurrentProcessId GetCurrentThreadId ResetEvent ResumeThread EncodePointer DecodePointer ExitThread LoadLibraryExW GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar ExitProcess GetModuleHandleExW AreFileApisANSI WideCharToMultiByte

user32

wsprintfA

shell32

SHGetSpecialFolderPathA

ws2_32

ioctlsocket WSAStringToAddressA connect inet_ntoa WSAStartup ntohl inet_addr htonl getaddrinfo WSARecv WSASend select htons ntohs getsockname shutdown setsockopt WSACleanup freeaddrinfo WSASetLastError closesocket getsockopt WSASocketA WSAGetLastError

Name

.text

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

411KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

file.dll

wininet

dnsapi

kernel32

user32

shell32

ws2_32

generic