{
  "family": "socks",
  "sample_count": 143,
  "category": "trojan",
  "description": "Proxy:Win32/Socks is a generic heuristic detection for malware or network components designed to silently establish an unauthorized SOCKS (Socket Secure) proxy server on the infected endpoint, routing malicious traffic through the victim's machine.<br><br><b>Understanding SOCKS Proxies</b><br>To the end-user, this behavior is invisible. For incident responders and network admins, an unauthorized SOCKS proxy is a critical threat. Attackers deploy SOCKS proxies on compromised endpoints to mask their true IP address. They then route their traffic (such as credential stuffing attacks against other organizations, or accessing illicit dark web content) through the victim's corporate network. To the outside world, the malicious activity appears to originate from your organization.<br><br><b>Execution and Threat Hunting</b><br>This module is frequently dropped as a secondary payload by larger botnets (like Trickbot or Emotet) or banking trojans. The malware opens a specific listening port (often a high, non-standard port like 40000+) on the infected endpoint and configures the Windows Firewall to allow incoming connections to it. It then signals the C2 server that the proxy is ready. Threat hunters will detect this by monitoring for anomalous listening ports utilizing <code>netstat -ano</code> or observing large volumes of inbound and outbound traffic on non-standard ports that do not match the expected behavior of the host application.<br><br><b>Forensic Analysis & Impact</b><br>The impact is severe reputational damage, IP blacklisting, and network congestion. Incident responders should immediately investigate EDR alerts for 'Suspicious Port Binding' or 'Firewall Rule Modification'. Analyzing the active connections to the rogue SOCKS port will reveal the attacker's actual infrastructure (inbound) and their intended targets (outbound).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.004",
    "T1105",
    "T1584",
    "T1090.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.002",
      "name": "Proxy: External Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1584",
      "name": "Compromise Infrastructure",
      "tactic": "Resource Development"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to stop the attacker from routing malicious traffic through your corporate IP space.",
    "Run <code>netstat -abno</code> to identify the specific executable binding to the rogue proxy port, and terminate the process using EDR.",
    "Audit the Windows Firewall rules (<code>wf.msc</code>) and delete any unauthorized inbound 'Allow' rules created by the malware.",
    "Perform a full forensic sweep to identify the primary trojan or botnet agent that dropped the SOCKS proxy module."
  ],
  "what_to_avoid": [
    "Do not simply block the port on the local firewall and leave the machine running; the malware will likely just bind to a new port on reboot.",
    "Avoid assuming the malicious traffic originated from your user; the proxy masks the true attacker's identity."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}