General

  • Target

    65b015e65a9fea301e972cf34503a255a480c57b8cd68aa26fdb4571c93a37a3

  • Size

    1.4MB

  • Sample

    211104-g6w79afhh9

  • MD5

    0d30d3d3cb5eadf25112c28aeca217b4

  • SHA1

    4d6736328111892491982d5fcd1189a31dc54cdc

  • SHA256

    65b015e65a9fea301e972cf34503a255a480c57b8cd68aa26fdb4571c93a37a3

  • SHA512

    da4fd3e15835640fb8e33a4f36805ee5fab83897092469dfb5d590362e8f895b89022899af8baaa22c6d8932ab3f03cc3060f2f60f83d884e0e3253efa259a95

Malware Config

Extracted

Family

socelars

C2

http://www.hhgenice.top/

Targets

    • Target

      65b015e65a9fea301e972cf34503a255a480c57b8cd68aa26fdb4571c93a37a3

    • Size

      1.4MB

    • MD5

      0d30d3d3cb5eadf25112c28aeca217b4

    • SHA1

      4d6736328111892491982d5fcd1189a31dc54cdc

    • SHA256

      65b015e65a9fea301e972cf34503a255a480c57b8cd68aa26fdb4571c93a37a3

    • SHA512

      da4fd3e15835640fb8e33a4f36805ee5fab83897092469dfb5d590362e8f895b89022899af8baaa22c6d8932ab3f03cc3060f2f60f83d884e0e3253efa259a95

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks