General

  • Target

    a6768194ebdd4c78978f19993eb4c685.exe

  • Size

    1.4MB

  • Sample

    211220-hxm4nahgg5

  • MD5

    a6768194ebdd4c78978f19993eb4c685

  • SHA1

    3c93ae4bf2b70f594db7b65bc0b12f3f4bd74352

  • SHA256

    b754c85a785c0d550dcc9503323606c9460e7ad46aba30b6980b102fb9655452

  • SHA512

    0897b075abd02cfa712513f27a0d3d801c6297b7bba847f58939c8ba94dae8cb346e7a5ab439c962244667510519f01880be5b90eb3873088b4d82b3bf333675

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Targets

    • Target

      a6768194ebdd4c78978f19993eb4c685.exe

    • Size

      1.4MB

    • MD5

      a6768194ebdd4c78978f19993eb4c685

    • SHA1

      3c93ae4bf2b70f594db7b65bc0b12f3f4bd74352

    • SHA256

      b754c85a785c0d550dcc9503323606c9460e7ad46aba30b6980b102fb9655452

    • SHA512

      0897b075abd02cfa712513f27a0d3d801c6297b7bba847f58939c8ba94dae8cb346e7a5ab439c962244667510519f01880be5b90eb3873088b4d82b3bf333675

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v6

Tasks