General

  • Target

    askinstall46.exe

  • Size

    1.4MB

  • Sample

    210616-b4qq74786j

  • MD5

    08e02983bf912205efca8487bb62107f

  • SHA1

    cfe6e8397409dac32ba08eb3d2d281604f6f3629

  • SHA256

    14b59820da7ad7abfb536b1303d7480c459bded64d0444f275a24168f90a4e53

  • SHA512

    f2cedecd3076d39e892dae912914f6b122287c94b36d18b98237bddb7f1e8133baf01ab6f96ffd6c4ffb19ab99632f78613a580760ce352de8a69cafa704d716

Malware Config

Targets

    • Target

      askinstall46.exe

    • Size

      1.4MB

    • MD5

      08e02983bf912205efca8487bb62107f

    • SHA1

      cfe6e8397409dac32ba08eb3d2d281604f6f3629

    • SHA256

      14b59820da7ad7abfb536b1303d7480c459bded64d0444f275a24168f90a4e53

    • SHA512

      f2cedecd3076d39e892dae912914f6b122287c94b36d18b98237bddb7f1e8133baf01ab6f96ffd6c4ffb19ab99632f78613a580760ce352de8a69cafa704d716

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks