By Yarin Leibovich

Introduction

I recently read an article by Cleafy about a new Android remote access tool (RAT) running in the wild called ‘Mirax’. As one of its functionalities is SOCKS5 proxy, I wondered to myself - How do modern malware operate proxy functionality in a modern approach? https://www.cleafy.com/cleafy-labs/mirax-a-new-android-rat-turning-infected-devices-into-potential-residential-proxy-nodes

Cleafy discovered that this malware contains a whole SOCKS5 Proxy Functionality, and therefore, the perfect example for my research.

Before delving into details of the MiraX RAT, let’s start with some basics:

Understanding proxy basics

What is a Proxy?

Think of a proxy as a middleman between a client and the internet. Instead of the destination receiving your data directly, the traffic is routed to the proxy server first. From there, the proxy server forwards the traffic to the destination from its address. As a result, you earn the benefits of anonymity and geolocation bypassing.

What is SOCKS Proxy

A SOCKS proxy is a modern approach to sending internet traffic through another server. This hides your real location and is more adaptable than older proxy types. Because SOCKS5 supports multiple connection types (TCP and UDP), it’s well-suited for activities like browsing the web, watching videos, and file sharing.

SOCKS5 Proxy vs HTTPS Proxy

Both HTTPS and SOCKS5 proxies use a server to send traffic elsewhere. However, an HTTPS proxy works at the application level, while SOCKS5 works at a lower network level. An HTTPS proxy secures the data sent between your browser and the proxy server. SOCKS5 is more adaptable and supports both TCP and UDP network types. This lets SOCKS5 support many applications, like clients, games, torrenting, and watching videos online.

[2] SOCKS vs HTTPS Proxy Illustration1

SOCKS5 Usage In Modern Malware

In recent years, threat actors have weaponized SOCKS5 proxy functionality within malware. This turns infected devices into a ‘zombie’ device to use as part of their operations. This setup establishes an authenticated and flexible tunnel back to a command and control server. By running a SOCKS5 server on a compromised machine, the attacker can route diverse traffic (both TCP and UDP) through the victim’s IP address.

This enables them to perform activities such as scanning internal subnets, accessing local network shares, and circumventing IP-based access control lists (ACLs) that would otherwise block access from the public internet.

Why do threat actors prefer SOCKS5?

As noted previously, Threat actors prefer SOCKS5 over simple protocols like HTTPS Proxies since they operate at the Transport level and are protocol agnostic - it does not care what application or service it is transferring. This allows for the attackers to:

Tunnel Non-HTTP Traffic: Perform RDP sessions, SSH, or database queries into internal networks.
Bypass Egress Filtering: If the environment allows outbound traffic on specific ports, the malware can wrap malicious payloads within a SOCKS5 stream to evade deep packet inspection that looks for HTTP Signatures.
Anonymize Infrastructure: By chaining multiple infected endpoints, the threat actor can mask the true origin of their C2 infrastructure.

How common is SOCKS5 functionality in malware?

In modern malware, the implementation of SOCKS5 is highly common, particularly within remote access tools and spyware. It is common since the logic of implementation is as simple as implementing common libraries such as “Libssh”.

MITRE even includes SOCKS Proxy functionality as a ‘Proxy Through Victim’ technique under the ‘Defense Evasion’ category (T1604)2.

Analysis of SOCKS5 in Modern Android Malware

Android malware may implement SOCKS5 proxy functionality to convert an infected device into a relay point for attacker-controlled traffic.

In this model, the Android malware not only steals data or provides remote access to the device, but it also exposes the compromised phone as a proxy node, allowing operators to route traffic through the victim’s legitimate mobile or residential IP address.

Recently, a new species of Android RAT was discovered called ‘Mirax’3. It is sold on the dark web as a MAAS (Malware As A Service). One of its malicious features is turning the phone into a functioning SOCKS5 Proxy node.

We are going to break down the SOCKS5 functionality from this exact malware sample to understand how it really operates under the hood.

MiraX Analysis

As the topic of this article is more about understanding the SOCKS functionality of the malware, I am not going to cover the whole analysis. It is recommended to go to Cleafy’s analysis of this malware right here3.

Code Obfuscation

First, I tried to do static analysis, but it was not possible since the code is heavily obfuscated with dead code wrappers and cryptographic functions. Therefore, I decided to skip the static analysis for now and jump straight to dynamic analysis.

To understand what I’m looking for, I looked for the main activity, but it does not exist - this probably means that this main class is packed with some sort of a packer - let’s try to see when it is created in memory.

I set up an emulator and launched the malware in addition to logcat to capture interesting information:

Bingo, there is a base.apk that is created on disk:

And then the main activity is launched:

We can see some debug message from the app it seems like it opens a webview.

Breakdown of MiraX SOCKS5 functionality:

Based on Cleafy OSINT research on this, the malware is created as part of a MAAS operation. In my obtained sample, the SOCKS5 proxy feature was disabled, but I was able to inspect the SOCKS5 configuration files and proxy infrastructure.

In addition, the way the malware operates the proxy function is quite interesting. This involves multiple layers of networking to establish and operate the feature. It includes a variety of settings to be customized. As a result, I am going to focus on the most basic connection layers.

The proxy contains 3 central layers:

Tunnel Manager
WebSocket
Yamux session

Now let’s explore each layer closely.

Layer 1: Tunnel Manager

A common way to build Android apps is by using special components called “Manager” objects. Think of each manager as having a specific job - like setting up and handling listeners for different things that happen in the app, or starting and keeping an eye on various background services.

In the MiraX malware, the authors included a component called ‘TunnelManager’. This object is instantiated within the malware after startup (if configured in the MAAS platform), and its purpose is to prepare the proxy infrastructure for the attacker.

Here is a brief breakdown of all its functionalities:

```

On start:

enable(config) → connect() → [WebSocket open] → sendHandshake() → YamuxSession created

On disable:

disable() → disconnect() → closes everything

```

[?] Example of the Tunnel Manager object ‘Enable’ method

The tunnel manager flow is to create the proxy tunnel based on the defined configuration to the attacker relay server. Then, after a connection has been established, it is responsible for orchestrating the data / stream receiving process, from data handling to relating the data back to the defined destination target.

Layer 2: WebSocket

This layer is the first station of each newly created communication tunnel. This layer gathers a fingerprint of the device and initiates a Websocket handshake request with the attacker relay server. If the connection is successful with the attacker relay server, a response with the string “socks5HandshakeAck” is sent.

A WebSocket connection provides a persistent, full-duplex communication channel over a single TCP connection. Unlike traditional HTTP connections, which are typically request-response based, WebSockets allow data to be sent from the server to the client (and vice versa) at any time without continuous polling.

In the context of MiraX, this is crucial for establishing a stable communication tunnel between the infected Android device and the attacker’s relay server. The malware uses a standard library (OkHttp) to manage this connection. After the initial handshake is completed, the connection is upgraded to the WebSocket protocol, which serves as the underlying transport layer for the subsequent data multiplexing handled by the Yamux protocol.

Example WebSocket connection flow

Layer 3: Yamux Session

Yamux4 is an application-level streaming multiplexing protocol. This protocol has an important role in a proxy chain - it takes bidirectional connections or, in a friendlier manner, “networking protocols” into a single data stream to transmit over a single communication channel (WebSocket). This turns a ‘Simple HTTP WebSocket’ into a pipeline capable of transferring a wide variety of application streams.

Yamux is often used over WebSockets, but it is transport-agnostic. It can run over any reliable, ordered pipe (TCP, TLS, etc.). It is important to note that WebSocket is just one possible transport.

Now, back to our beloved malware: MiraX. for every communication channel initiated by the attacker relay server, a new Yamux session is opened.

It is important to note that although MiraX malware implements Yamux, that does not mean every use of Yamux equals malicious activity. Yamux is used for benign activities such as:

Secure Reverse Tunnels - Yamux is ideal for scenarios where a client behind a NAT needs to expose services to a public server
P2P Networking (libp2p) - Yamux is a primary stream multiplexing choice for libp2p, the networking stack used by projects like IPFS and Ethereum 2.0.
HashiCorp Terraform & Vault Plugins - Yamux is a HashiCorp product, and they use its implementation inside their Terraform and Vault plugins.

MiraX SOCKS5 functionality conclusions

I had a good time cracking down on the sophisticated approach MiraX utilizes for mobile proxying. By layering specialized protocols, the malware bypasses traditional defenses. This setup uses a TunnelManager component to orchestrate the environment, while WebSockets maintain persistent, full-duplex communication. Finally, Yamux is used to multiplex diverse data streams over a single connection, resulting in a resilient and scalable infrastructure for the threat actors.

It is important to note that while Yamux is a legitimate tool frequently employed in P2P networking and enterprise plugins for its efficiency, its implementation within MiraX highlights a growing trend: threat actors weaponizing robust, open-source transport protocols. This allows them to mask malicious traffic within “normal” looking long-lived connections.

The following flow chart demonstrates the flow of MiraX SOCKS5 proxy stages:

Current Trends and the Horizon of Proxy Capabilities

Robert Kiyosaki, the author of “Rich Dad Poor Dad” once said, “The best way to try and predict the future is by studying the past…” so I did. In addition to MiraX, I have collected a table containing all major malware families implementing a SOCKS5 proxy functionality.

The table is updated to May 2026, and its information goes back up to early 2021:

Malware family	Type	SOCKS5 role on the device
Anubis5	Android banking trojan	Implements a SOCKS5 proxy on the phone for covert comms and package
Godfather6	Android banking trojan (successor to Anubis)	Has C2 commands like `startsocks5` / `stopsocks5` to enable/disable a SOCKS5 proxy with host/user/pass/port on the device.
GoldPickaxe (Android)7	Android/iOS banking & ID‑theft trojan (GoldFactory family)	Creates a SOCKS5 proxy server and Fast Reverse Proxy (FRP) using Golang mobile bindings, explicitly documented for Android and iOS
TrickMo (new Android variant)8	Android banking trojan (TrickBot mobile lineage)	New 2026 variant adds socket‑level tunneling via an embedded SSH client and an on‑device SOCKS5 proxy with authentication, effectively turning the phone into a programmable network pivot.

The documented cases of SOCKS5 integration across prominent malware families like Anubis, Godfather, GoldPickaxe, and the new TrickMo variant demonstrate that this capability is now a standard feature in high-impact Android threats. The consistent function across these variants is to establish the compromised device as an authenticated network pivot, thereby facilitating covert communication and advanced network evasion strategies. This evolution confirms SOCKS5’s transition from a niche capability to a central mechanism for enabling threat actor operations, including sophisticated network tunneling and circumvention of egress filtering.

Conclusions

To conclude, MiraX malware is an example of a modern Android malware implementing the SOCKS5 feature. This is the first time I am reversing a MAAS malware, so it was quite a challenge.

To conclude, the landscape of mobile malware has fundamentally shifted, with SOCKS5 proxy functionality becoming a standard and central mechanism for threat actors seeking to maximize control and utility from an infected device.

This evolution is driven by the SOCKS5 protocol’s agnostic nature, which operates at the Transport level and does not require additional device permissions. This offers a significant advantage over application-level proxies. It enables the compromised device to serve as a versatile, authenticated network pivot, thereby facilitating advanced network evasion and covert communication strategies.

The high-impact Android threats, including prominent families like Anubis, Godfather, GoldPickaxe, and the latest TrickMo variant, consistently feature SOCKS5 integration, underscoring its transition from a niche capability to a required feature. By running a SOCKS5 server on the victim’s machine, the malware turns the device into a ‘zombie’ node, allowing attackers to route diverse TCP and UDP traffic through the victim’s legitimate mobile or residential IP address. This maximizes utility by enabling activities such as scanning internal subnets, accessing local network shares, managing massive botnet chains for DDoS attacks, and circumventing IP-based access control lists that rely on IP reputation.

Furthermore, modern implementations, as demonstrated by the MiraX RAT, show increasing sophistication by layering specialized protocols. The use of a TunnelManager component to orchestrate the environment, WebSockets for persistent, full-duplex communication, and Yamux to multiplex diverse data streams over a single connection results in a highly resilient and scalable infrastructure. This trend of weaponizing robust, open-source transport protocols to mask malicious traffic within long-lived, normal-looking connections poses a significant challenge to traditional defense mechanisms, confirming SOCKS5 as a core enabler for current and future threat actor operations.

SOCKS5 Proxy Malware In Modern Android Malware