General

  • Target

    31f6b2929bd25668ffcfc8216af735a5.exe

  • Size

    1.4MB

  • Sample

    211231-g8c76agfc8

  • MD5

    31f6b2929bd25668ffcfc8216af735a5

  • SHA1

    f77aba621c36609549a97ed8f8592a501e040f76

  • SHA256

    8ea9c5b6af17446b164b3aab8e52907d5c31b16c3e71690a40832a22a9fc8a2a

  • SHA512

    057825daec09487f7ca784430d16247dd64b2ff018aadbe84164f4710403fb291319d26d4855a508b26fdb840327483931c24413ddd8ad060093fecec4ba8c64

Malware Config

Extracted

Family

socelars

C2

http://www.chosenncrowned.com/

Targets

    • Target

      31f6b2929bd25668ffcfc8216af735a5.exe

    • Size

      1.4MB

    • MD5

      31f6b2929bd25668ffcfc8216af735a5

    • SHA1

      f77aba621c36609549a97ed8f8592a501e040f76

    • SHA256

      8ea9c5b6af17446b164b3aab8e52907d5c31b16c3e71690a40832a22a9fc8a2a

    • SHA512

      057825daec09487f7ca784430d16247dd64b2ff018aadbe84164f4710403fb291319d26d4855a508b26fdb840327483931c24413ddd8ad060093fecec4ba8c64

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v6

Tasks