GhostSocks is a Malware-as-a-Service that converts compromised devices into residential SOCKS5 proxies, leveraging partnerships (notably with LummaStealer) to monetize infected hosts and bypass anti-fraud measures. The service provides obfuscated Golang binaries, uses a pool of relay servers for back-connect, and continues active development despite forum disruptions and law enforcement actions. #GhostSocks #LummaStealer
Keypoints
- GhostSocks was publicly marketed on the Russian forum xss[.]is beginning October 15, 2023, as a MAAS enabling conversion of compromised machines into residential proxies.
- Adoption grew after a February 2024 partnership with LummaStealer, allowing Lumma clients to deploy GhostSocks to further monetize compromised devices.
- GhostSocks binaries are written in Golang, use the open-source garble project for string/symbol obfuscation, and decrypt strings at runtime.
- The malware does not implement persistence; its primary functionality is establishing SOCKS5 proxy back-connects using go-socks5 and yamux libraries.
- Startup behavior includes mutex “start to run”, locating a dynamic config in %TEMP% with a fallback to hardcoded C2 URLs that are iterated until connection succeeds.
- On successful C2 contact GhostSocks generates random proxy credentials, registers with the server via HTTP (including an x-api-key header), and provisions the SOCKS5 proxy.
- Despite law enforcement disruption of related forums and Lumma infrastructure, GhostSocks remains active and maintained, posing ongoing risk through proxy resale and double victimization.
MITRE Techniques
- [T1071 ] Application Layer Protocol – GhostSocks uses HTTP to register with C2 and manage proxies: “…http://46[.]8[.]232[.]106:30001/api/helper-first-register?buildVersion=…&proxyPassword=&proxyUsername=&userId=”
- [T1095 ] Non-Application Layer Protocol – GhostSocks provisions SOCKS5 proxy back-connects and uses the go-socks5 library to relay traffic (“spawn a SOCKS5 connection using the open-source go-socks5 and yamux libraries.”)
- [T1027 ] Obfuscated Files or Information – GhostSocks leverages the garble project to obfuscate strings and symbols and decrypts them at runtime: “These strings are decrypted at runtime by calling a decrypt routine before usage.”
- [T1078 ] Valid Accounts – GhostSocks generates and registers random proxy credentials with C2 to configure access: “GhostSocks will randomly generate a password and username, which will be sent to the C2 server, configuring it for usage.”
- [T1105 ] Ingress Tool Transfer – GhostSocks binaries (32-bit DLL or executable) are delivered by other malware like LummaStealer as part of a secondary deployment: “Lumma clients could install GhostSocks and steal user data, allowing them to further monetize the compromised device even post infection.”
- [T1036 ] Masquerading – GhostSocks can be distributed and used as a proxy service to disguise malicious traffic as legitimate residential traffic and bypass anti-fraud controls: “MAAS’s ability to bypass anti-fraud mechanisms, allowing threat actors to capitalize on the victim’s machine.”
Indicators of Compromise
- [IP Address ] GhostSocks C2/relay example – 46.8.232.106:30001 (C2 registration endpoint shown in config)
- [File/Artifact Name ] Binaries and mutex – 32-bit DLL or executable coded in Golang; mutex string “start to run”
- [URL ] C2 registration and API endpoints – http://46[.]8[.]232[.]106:30001/api/helper-first-register?… (defanged form shown in report)
- [Configuration Location ] Dynamic config path – %TEMP% (GhostSocks attempts to locate a dynamic configuration file there; if missing it uses hardcoded config)
- [Libraries/Tools ] Open-source components used – garble (string obfuscation), go-socks5 and yamux (SOCKS5 and multiplexing)
Read more: https://synthient.com/blog/ghostsocks-from-initial-access-to-residential-proxy