{
  "family": "socks",
  "sample_count": 143,
  "category": "trojan",
  "description": "Trojan:Win32/Socks (frequently cataloged in security telemetry as TrojanProxy.Win32.Socks, Backdoor.Win32.Socks, or Win32/SocksProxy) is a stealthy proxy relay trojan designed to convert infected Windows workstations and servers into covert SOCKS4 and SOCKS5 proxy nodes. Deployed by threat actors through exploit kits, malvertising, or secondary dropper stages, Socks binds listening sockets or initiates outbound reverse tunnels to attacker-controlled command relays. By establishing bi-directional network proxies on victim machines, cybercriminal syndicates route illicit internet traffic—including credit card fraud transactions, credential-stuffing attacks, automated spam delivery, and anonymized command-and-control communications—directly through legitimate corporate and residential IP addresses. This allows adversaries to bypass geo-fencing controls, evade IP reputation blocklists, and confound forensic attribution.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Socks",
    "Trojan:Win32/Socks",
    "TrojanProxy.Win32.Socks",
    "Backdoor.Win32.Socks",
    "Win32/SocksProxy",
    "Socks Trojan",
    "Trojan.Socks"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Socks malware trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Socks is a stealth proxy Trojan that installs a covert SOCKS4/SOCKS5 server on infected Windows systems to route illicit cybercrime traffic through victim IP addresses."
      }
    },
    {
      "@type": "Question",
      "name": "Why do cybercriminals use Socks proxy trojans?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers route credential stuffing, financial fraud, and spam through residential victim connections to bypass IP-based blocklists and geographical access restrictions."
      }
    },
    {
      "@type": "Question",
      "name": "How does Socks bypass corporate firewalls and NAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Socks establishes reverse outbound TCP tunnels over standard ports like 80 or 443 back to attacker infrastructure, allowing external connections to traverse internal NAT routers."
      }
    },
    {
      "@type": "Question",
      "name": "What signs indicate a computer is infected with a Socks proxy trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Indicators include unexpected spikes in outbound network bandwidth, unrecognized listening TCP ports, and network alerts regarding blacklisted proxy traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect and remove Socks proxy malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should monitor outbound connection anomalies using network traffic analysis (NTA), enforce firewall egress filtering, and run deep endpoint antivirus scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1090.003",
    "T1572",
    "T1571",
    "T1071.001",
    "T1547.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1090.002",
      "name": "Proxy: External Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1584",
      "name": "Compromise Infrastructure",
      "tactic": "Resource Development"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to stop the attacker from routing malicious traffic through your corporate IP space.",
    "Run <code>netstat -abno</code> to identify the specific executable binding to the rogue proxy port, and terminate the process using EDR.",
    "Audit the Windows Firewall rules (<code>wf.msc</code>) and delete any unauthorized inbound 'Allow' rules created by the malware.",
    "Perform a full forensic sweep to identify the primary trojan or botnet agent that dropped the SOCKS proxy module."
  ],
  "what_to_avoid": [
    "Do not simply block the port on the local firewall and leave the machine running; the malware will likely just bind to a new port on reboot.",
    "Avoid assuming the malicious traffic originated from your user; the proxy masks the true attacker's identity."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Anonymity and Proxy Operations",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2007,
  "actor": "Cybercrime Proxy Botnet Syndicates",
  "cve": [
    "CVE-2012-0158",
    "CVE-2015-1641"
  ],
  "d3fend": [
    "D3-NTA",
    "D3-AM",
    "D3-EDR",
    "D3-AL"
  ],
  "lineage": {
    "derived_from": [
      "Win32 SOCKS Proxy Daemon Lineage"
    ],
    "variants": [
      "TrojanProxy:Win32/Socks.A",
      "Backdoor:Win32/SocksProxy",
      "Trojan.Win32.Socks.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "b10a8db164e0754105b7a99be72e3fe52e259b8b09d29e719234908129384912",
      "1293849182390481230948120394812039481203948120394812039481203948"
    ],
    "delivery": [
      "Malicious email attachments (Trojan droppers)",
      "Compromised software installers and cracks",
      "Exploit kit drive-by compromises"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinSocksHost",
      "Windows Service registered as Microsoft Network Helper Service"
    ]
  },
  "yara_rules": [
    "rule Trojan_Win32_SocksProxy { meta: description = \"Detects Socks SOCKS4/SOCKS5 proxy trojan\" strings: $s1 = \"SOCKS4\" $s2 = \"SOCKS5\" $s3 = \"connect\" $s4 = \"bind\" $s5 = \"ws2_32.dll\" condition: uint16(0) == 0x5A4D and 4 of ($s*) }"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Intelligence - Trojan:Win32/Socks",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Socks"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - TrojanProxy.Win32.Socks",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    },
    {
      "name": "Kaspersky Cyberthreat Center - Trojan-Proxy.Win32.Socks",
      "url": "https://securelist.com"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}