Socks

Overview

Proxy:Win32/Socks is a generic heuristic detection for malware or network components designed to silently establish an unauthorized SOCKS (Socket Secure) proxy server on the infected endpoint, routing malicious traffic through the victim's machine.

Understanding SOCKS Proxies
To the end-user, this behavior is invisible. For incident responders and network admins, an unauthorized SOCKS proxy is a critical threat. Attackers deploy SOCKS proxies on compromised endpoints to mask their true IP address. They then route their traffic (such as credential stuffing attacks against other organizations, or accessing illicit dark web content) through the victim's corporate network. To the outside world, the malicious activity appears to originate from your organization.

Execution and Threat Hunting
This module is frequently dropped as a secondary payload by larger botnets (like Trickbot or Emotet) or banking trojans. The malware opens a specific listening port (often a high, non-standard port like 40000+) on the infected endpoint and configures the Windows Firewall to allow incoming connections to it. It then signals the C2 server that the proxy is ready. Threat hunters will detect this by monitoring for anomalous listening ports utilizing <code>netstat -ano or observing large volumes of inbound and outbound traffic on non-standard ports that do not match the expected behavior of the host application.

Forensic Analysis & Impact
The impact is severe reputational damage, IP blacklisting, and network congestion. Incident responders should immediately investigate EDR alerts for 'Suspicious Port Binding' or 'Firewall Rule Modification'. Analyzing the active connections to the rogue SOCKS port will reveal the attacker's actual infrastructure (inbound) and their intended targets (outbound).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SOCKS {
    meta:
        description = "Detects Socks (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "socks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Socks Activity
id: 3e5a1b3b990187c9fb8e8156ce25c243
status: experimental
description: Detects generic indicators of the socks malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*socks*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to stop the attacker from routing malicious traffic through your corporate IP space.
2. Run <code>netstat -abno</code> to identify the specific executable binding to the rogue proxy port, and terminate the process using EDR.
3. Audit the Windows Firewall rules (<code>wf.msc</code>) and delete any unauthorized inbound 'Allow' rules created by the malware.
4. Perform a full forensic sweep to identify the primary trojan or botnet agent that dropped the SOCKS proxy module.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply block the port on the local firewall and leave the machine running; the malware will likely just bind to a new port on reboot.
2. Avoid assuming the malicious traffic originated from your user; the proxy masks the true attacker's identity.

References & External Analysis

• Search "socks" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Umbra
• Netwiredrc
• Perflogger
• Mirc
• Waldek

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/socks.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.