General

  • Target

    askinstall59.exe

  • Size

    1.4MB

  • Sample

    211024-dmtq8sdhaq

  • MD5

    91fc5a9d9ddf6868e41cba2eb0e8e92d

  • SHA1

    5bf358a41876254760650518cee379b1ad0c17d5

  • SHA256

    5876c046abaa28048e204be22470eeb20cbd975c25191a0ac8a5edd844a58aa0

  • SHA512

    d23f8687b4dbaa941b3cf954b63f141e7fc94ce5d362c9fd0ce8da03e049a14d803db61eb69c3da1db368623e6f79f2b7a02fab8316ec2b0693292642e9b6da1

Malware Config

Targets

    • Target

      askinstall59.exe

    • Size

      1.4MB

    • MD5

      91fc5a9d9ddf6868e41cba2eb0e8e92d

    • SHA1

      5bf358a41876254760650518cee379b1ad0c17d5

    • SHA256

      5876c046abaa28048e204be22470eeb20cbd975c25191a0ac8a5edd844a58aa0

    • SHA512

      d23f8687b4dbaa941b3cf954b63f141e7fc94ce5d362c9fd0ce8da03e049a14d803db61eb69c3da1db368623e6f79f2b7a02fab8316ec2b0693292642e9b6da1

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks