General

  • Target

    950669e375840b68d7dde4faaf53d4a0.exe

  • Size

    1.4MB

  • Sample

    220612-redxpsedfm

  • MD5

    950669e375840b68d7dde4faaf53d4a0

  • SHA1

    e87d8d1e32fee1b965a65f3f0da16c2af9ad3dbb

  • SHA256

    8238820f7694992ae716555a5fd80f99d242f5f080dae4525ee26b952a6ab8ed

  • SHA512

    723d78ae741ef9d03f230c074ae8a4615ece426fa74c0765da1aa1907fa8db2c767619473ac1647acc9f375de30326e4d23cea66a410c173e978b70e29ed71ce

Malware Config

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/ujfreids61/

Targets

    • Target

      950669e375840b68d7dde4faaf53d4a0.exe

    • Size

      1.4MB

    • MD5

      950669e375840b68d7dde4faaf53d4a0

    • SHA1

      e87d8d1e32fee1b965a65f3f0da16c2af9ad3dbb

    • SHA256

      8238820f7694992ae716555a5fd80f99d242f5f080dae4525ee26b952a6ab8ed

    • SHA512

      723d78ae741ef9d03f230c074ae8a4615ece426fa74c0765da1aa1907fa8db2c767619473ac1647acc9f375de30326e4d23cea66a410c173e978b70e29ed71ce

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks