GhostSocks (Malware Family)

GhostSocks

VTCollection

GhostSocks, a Golang-based proxy malware, was first advertised as a Malware-as-a-Service (MaaS) on Russian-speaking underground forums in October 2023. It uses back-connect socket secure internet protocol (SOCKS5) connections and is available for rent for US $100 per month. In February 2024, the author of Lumma Stealer released an update introducing the integration of proxying capabilities. This feature, developed in partnership with GhostSocks, allows the use of infected hosts as SOCKS5 proxies and is available to all subscribers who purchase the "Professional" or higher tier plan. This integration allows Lumma Stealer users to establish a network of residential IP addresses for various purposes, including credential checking, spam distribution, or as general-purpose proxies.

References

2026-04-03 ⋅ Trend Micro ⋅ Jacob Santos, Jeffrey Francis Bonaobra, Sophia Nilette Robles
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
GhostSocks Vidar

2026-04-01 ⋅ Zscalar ⋅ Avinash Kumar, Jithin Prajeev Nair, Mallikarjun Piddannavar, Manisha Ramcharan Prajapati
Anthropic Claude Code Leak
GhostSocks Vidar

2026-03-26 ⋅ Darktrace ⋅ Isabel Evans
Phantom Footprints: Tracking GhostSocks Malware
GhostSocks Lumma Stealer

2026-03-04 ⋅ Huntress Labs ⋅ Jai Minton, Ryan Dowd
"Malware, from the Outside!": How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
GhostSocks Vidar

2025-09-30 ⋅ Synthient ⋅ Synthient
GhostSocks: From Initial Access to Residential Proxy
GhostSocks Lumma Stealer

2025-03-25 ⋅ SpyCloud ⋅ James
On the Hunt for Ghost(Socks)
GhostSocks

2025-02-20 ⋅ Infrawatch ⋅ Infrawatch Research Team
GhostSocks - Lumma's Partner In Proxy
GhostSocks Lumma Stealer

2025-01-27 ⋅ The DFIR Report ⋅ MittenSec, MyDFIR, r3nzsec
Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware
GhostSocks LockBit SystemBC

2024-12-19 ⋅ SpyCloud ⋅ James
LummaC2 Revisited: What’s Making this Stealer Stealthier and More Lethal
GhostSocks Lumma Stealer

2024-12-10 ⋅ Zscaler ⋅ ThreatLabZ research team
Inside Zloader’s Latest Trick: DNS Tunneling
GhostSocks Zloader

2024-08-12 ⋅ Rapid7 ⋅ Tyler McGraw
Ongoing Social Engineering Campaign Refreshes Payloads
Black Basta Cobalt Strike GhostSocks Lumma Stealer SystemBC

2024-02-05 ⋅ @g0njxa
Tweet Highlighting the Integration of GhostSocks Service into Lumma Stealer
GhostSocks

Yara Rules

[TLP:WHITE] win_ghostsocks_auto (20260917 | Detects win.ghostsocks.)

rule win_ghostsocks_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.ghostsocks."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 8d3c24 8db424ac030000 e8???????? }
            // n = 4, score = 300
            //   e8????????           |                     
            //   8d3c24               | lea                 edi, [esp]
            //   8db424ac030000       | lea                 esi, [esp + 0x3ac]
            //   e8????????           |                     

        $sequence_1 = { e8???????? 8b8424d4010000 8b08 8b9424ac000000 }
            // n = 4, score = 300
            //   e8????????           |                     
            //   8b8424d4010000       | mov                 eax, dword ptr [esp + 0x1d4]
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   8b9424ac000000       | mov                 edx, dword ptr [esp + 0xac]

        $sequence_2 = { e8???????? 90 8b8424b0000000 890424 }
            // n = 4, score = 300
            //   e8????????           |                     
            //   90                   | nop                 
            //   8b8424b0000000       | mov                 eax, dword ptr [esp + 0xb0]
            //   890424               | mov                 dword ptr [esp], eax

        $sequence_3 = { e8???????? 8b8c2484010000 898c24e0000000 8b9c2488010000 }
            // n = 4, score = 300
            //   e8????????           |                     
            //   8b8c2484010000       | mov                 ecx, dword ptr [esp + 0x184]
            //   898c24e0000000       | mov                 dword ptr [esp + 0xe0], ecx
            //   8b9c2488010000       | mov                 ebx, dword ptr [esp + 0x188]

        $sequence_4 = { e8???????? 8d3c24 8db424a0000000 e8???????? }
            // n = 4, score = 300
            //   e8????????           |                     
            //   8d3c24               | lea                 edi, [esp]
            //   8db424a0000000       | lea                 esi, [esp + 0xa0]
            //   e8????????           |                     

        $sequence_5 = { e8???????? 8b842420010000 8907 8b5114 }
            // n = 4, score = 300
            //   e8????????           |                     
            //   8b842420010000       | mov                 eax, dword ptr [esp + 0x120]
            //   8907                 | mov                 dword ptr [edi], eax
            //   8b5114               | mov                 edx, dword ptr [ecx + 0x14]

        $sequence_6 = { e8???????? 90 8b842488000000 8b4c2474 }
            // n = 4, score = 300
            //   e8????????           |                     
            //   90                   | nop                 
            //   8b842488000000       | mov                 eax, dword ptr [esp + 0x88]
            //   8b4c2474             | mov                 ecx, dword ptr [esp + 0x74]

        $sequence_7 = { e8???????? 90 8b84242c010000 890424 89442404 8b8c2430010000 }
            // n = 6, score = 300
            //   e8????????           |                     
            //   90                   | nop                 
            //   8b84242c010000       | mov                 eax, dword ptr [esp + 0x12c]
            //   890424               | mov                 dword ptr [esp], eax
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   8b8c2430010000       | mov                 ecx, dword ptr [esp + 0x130]

        $sequence_8 = { e8???????? 8985603efbff 8995643efbff 8b95bcaffcff }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8985603efbff         | mov                 dword ptr [ebp - 0x4c1a0], eax
            //   8995643efbff         | mov                 dword ptr [ebp - 0x4c19c], edx
            //   8b95bcaffcff         | mov                 edx, dword ptr [ebp - 0x35044]

        $sequence_9 = { e8???????? 8985603efaff 8995643efaff 0fbe15???????? }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8985603efaff         | mov                 dword ptr [ebp - 0x5c1a0], eax
            //   8995643efaff         | mov                 dword ptr [ebp - 0x5c19c], edx
            //   0fbe15????????       |                     

        $sequence_10 = { e8???????? 89856026fcff 89956426fcff 0fb615???????? 0fb60d???????? d3fa 8815???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   89856026fcff         | mov                 dword ptr [ebp - 0x3d9a0], eax
            //   89956426fcff         | mov                 dword ptr [ebp - 0x3d99c], edx
            //   0fb615????????       |                     
            //   0fb60d????????       |                     
            //   d3fa                 | sar                 edx, cl
            //   8815????????         |                     

        $sequence_11 = { e8???????? 8985602efaff 8995642efaff 0fbe95e2e5faff }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8985602efaff         | mov                 dword ptr [ebp - 0x5d1a0], eax
            //   8995642efaff         | mov                 dword ptr [ebp - 0x5d19c], edx
            //   0fbe95e2e5faff       | movsx               edx, byte ptr [ebp - 0x51a1e]

        $sequence_12 = { e8???????? 8985603cfeff 8995643cfeff 8b8544d8faff }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8985603cfeff         | mov                 dword ptr [ebp - 0x1c3a0], eax
            //   8995643cfeff         | mov                 dword ptr [ebp - 0x1c39c], edx
            //   8b8544d8faff         | mov                 eax, dword ptr [ebp - 0x527bc]

        $sequence_13 = { e8???????? 8985602cffff 8995642cffff 0fb685b391fcff }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8985602cffff         | mov                 dword ptr [ebp - 0xd3a0], eax
            //   8995642cffff         | mov                 dword ptr [ebp - 0xd39c], edx
            //   0fb685b391fcff       | movzx               eax, byte ptr [ebp - 0x36e4d]

        $sequence_14 = { e8???????? 89856026fcff 89956426fcff 8b8d00f4feff 0fb601 0fb60d???????? }
            // n = 6, score = 100
            //   e8????????           |                     
            //   89856026fcff         | mov                 dword ptr [ebp - 0x3d9a0], eax
            //   89956426fcff         | mov                 dword ptr [ebp - 0x3d99c], edx
            //   8b8d00f4feff         | mov                 ecx, dword ptr [ebp - 0x10c00]
            //   0fb601               | movzx               eax, byte ptr [ecx]
            //   0fb60d????????       |                     

        $sequence_15 = { e8???????? 89856026fcff 89956426fcff a1???????? 0fb608 8b952805ffff }
            // n = 6, score = 100
            //   e8????????           |                     
            //   89856026fcff         | mov                 dword ptr [ebp - 0x3d9a0], eax
            //   89956426fcff         | mov                 dword ptr [ebp - 0x3d99c], edx
            //   a1????????           |                     
            //   0fb608               | movzx               ecx, byte ptr [eax]
            //   8b952805ffff         | mov                 edx, dword ptr [ebp - 0xfad8]

    condition:
        7 of them and filesize < 25016320
}

Download all Yara Rules

GhostSocks Propose Change

References

Yara Rules

GhostSocks