socelars | Eqsdqsd[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Eqsdqsd.zip
Size 3.4MB
Sample220101-ryw8dsgbhj
SHA256 b931c903ff14d82dce6daf9934209b5c71f982359847ed3e342e25fa88c99f03
MD5 194572ede01daaccc5f7a617b5c08468
SHA1 b069072234d68d8ef01c49237c392735d45c4901
SHA512 caa033d5a30e1c340455faebaf417d2bca2b0c95a24063df2bee78de8955d6d337f82bc16627583672e42f15022073ddbaaedc6f5a6984fdb65efb9f6a57bbae
MD5 SHA1 SHA512

Score

10^/10

socelars

Malware Config

Extracted

Family

socelars

C2

http://www.chosenncrowned.com/

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/rUtfalBbvXy6eEmMrseqpFHx.exe	Nirsoft

Socelars Payload 1 IoCs

resource	yara_rule
static1/unpack001/Osz8mRDYP0laXozOTuxyUiiF.exe	family_socelars

Socelars family
socelars

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
static1/unpack001/rUtfalBbvXy6eEmMrseqpFHx.exe	WebBrowserPassView

File Explorer

Eqsdqsd.zip

.zip 3.4MB
OkEgjVmQ0rPYTjBDwBy70NyH.exe

.exe 1.8MB
Osz8mRDYP0laXozOTuxyUiiF.exe

.exe 1.4MB
rUtfalBbvXy6eEmMrseqpFHx.exe

.exe 2.0MB

Eqsdqsd.zip

SHA256 b931c903ff14d82dce6daf9934209b5c71f982359847ed3e342e25fa88c99f03
MD5 194572ede01daaccc5f7a617b5c08468
SHA1 b069072234d68d8ef01c49237c392735d45c4901
SHA512 caa033d5a30e1c340455faebaf417d2bca2b0c95a24063df2bee78de8955d6d337f82bc16627583672e42f15022073ddbaaedc6f5a6984fdb65efb9f6a57bbae
MD5 SHA1 SHA512