PROXYBOX
Providerhigh riskproxy provider intelligence profile
- Website
proxybox[.]io- Gateway
178[.]16[.]55[.]185:47814
Proxybox is a proxy service powered by the Socks5Systemz botnet. The service distributes a heavily obfuscated loader disguised as a legitimate applications. The loader is used to install the Socks5Systemz malware on victim machines, which then become part of the botnet and provide proxy services to customers.
Observables
Network Observables
| IP Address | ASN | ASN Name | Country | Description |
|---|---|---|---|---|
| 178.16.53.192 | AS214943 | RAILNET | US | C2 Server |
| 86.54.42.188 | AS42624 | swissnetwork02 | SC | C2 Server |
| 45.11.182.82 | AS42708 | GLESYS | SE | C2 Server |
| 142.132.212.125:1000 | AS24940 | Hetzner Online GmbH | DE | Relay Server |
| 65.108.127.141:1000 | AS24940 | Hetzner Online GmbH | FI | Relay Server |
| 213.160.130.66:2000 | AS12963 | VOLZ LLC | UA | Relay Server |
| 168.119.213.115:5000 | AS24940 | Hetzner Online GmbH | DE | Relay Server |
| 45.155.249.180:2000 | AS58329 | servinga GmbH | NL | Relay Server |
- IP Address
- 178.16.53.192
- ASN
- AS214943
- ASN Name
- RAILNET
- Country
- US
- Description
- C2 Server
- IP Address
- 86.54.42.188
- ASN
- AS42624
- ASN Name
- swissnetwork02
- Country
- SC
- Description
- C2 Server
- IP Address
- 45.11.182.82
- ASN
- AS42708
- ASN Name
- GLESYS
- Country
- SE
- Description
- C2 Server
- IP Address
- 142.132.212.125:1000
- ASN
- AS24940
- ASN Name
- Hetzner Online GmbH
- Country
- DE
- Description
- Relay Server
- IP Address
- 65.108.127.141:1000
- ASN
- AS24940
- ASN Name
- Hetzner Online GmbH
- Country
- FI
- Description
- Relay Server
- IP Address
- 213.160.130.66:2000
- ASN
- AS12963
- ASN Name
- VOLZ LLC
- Country
- UA
- Description
- Relay Server
- IP Address
- 168.119.213.115:5000
- ASN
- AS24940
- ASN Name
- Hetzner Online GmbH
- Country
- DE
- Description
- Relay Server
- IP Address
- 45.155.249.180:2000
- ASN
- AS58329
- ASN Name
- servinga GmbH
- Country
- NL
- Description
- Relay Server
File Observables
| SHA-256 | Filename | Description |
|---|---|---|
e4652015451b4c0e2a288e70d3f9900cbaf9d3f5e48ef0861f4ae1ec645792fb | Stage 1 loader | Socks5Systemz Stage 1 loader |
e82b1cd545da66c5e44fc9b83cedb81bf49377d206e9ac5385c1b25d9c241a6a | Stage 2 loader | Socks5Systemz Stage 2 loader |
08e4910a66629286a67eb6e5097bf0efdd051d21657dec1e1d1c8af28cd5e1bf | Unpacked module | Socks5Systemz unpacked module |
- SHA-256
e4652015451b4c0e2a288e70d3f9900cbaf9d3f5e48ef0861f4ae1ec645792fb- Filename
- Stage 1 loader
- Description
- Socks5Systemz Stage 1 loader
- SHA-256
e82b1cd545da66c5e44fc9b83cedb81bf49377d206e9ac5385c1b25d9c241a6a- Filename
- Stage 2 loader
- Description
- Socks5Systemz Stage 2 loader
- SHA-256
08e4910a66629286a67eb6e5097bf0efdd051d21657dec1e1d1c8af28cd5e1bf- Filename
- Unpacked module
- Description
- Socks5Systemz unpacked module
Host Observables
| Path | Description |
|---|---|
C:\ProgramData\GameBackupManager | Loader installation directory |
C:\ProgramData\QW14102it%d.dat | Temporary file |
C:\ProgramData\QW14102resa.dat | Temporary file |
C:\Users\<user>\AppData\Local\Game Backup Manager 1.1.2.4363 | Application directory |
- Path
C:\ProgramData\GameBackupManager- Description
- Loader installation directory
- Path
C:\ProgramData\QW14102it%d.dat- Description
- Temporary file
- Path
C:\ProgramData\QW14102resa.dat- Description
- Temporary file
- Path
C:\Users\<user>\AppData\Local\Game Backup Manager 1.1.2.4363- Description
- Application directory
Provider intelligence
Get access to the full data.
Subscribe to access countries, traffic mix, network rankings, raw IPs, subnets, related pools, and alerts.