General

  • Target

    3ffb13019a60f597584feade7356c294ad40b132f5b9faf180c1756b24c4e1a0

  • Size

    1.4MB

  • Sample

    220630-v9he6agcb4

  • MD5

    c31bfd6375ba5281c557bc3d03135dff

  • SHA1

    71b70d53b1c88bd07b26a99b3fcc576ccd6e221f

  • SHA256

    3ffb13019a60f597584feade7356c294ad40b132f5b9faf180c1756b24c4e1a0

  • SHA512

    5ab0e37c0de108afdd3bb94dd9ba2c5279a2238e3125e02d1eea49b8dd191ba647156c15eaa3d422d216a53dcbbacd9ddda360fe2dd4c0895a1474f19a50a1ef

Malware Config

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/qwwgh/

Targets

    • Target

      3ffb13019a60f597584feade7356c294ad40b132f5b9faf180c1756b24c4e1a0

    • Size

      1.4MB

    • MD5

      c31bfd6375ba5281c557bc3d03135dff

    • SHA1

      71b70d53b1c88bd07b26a99b3fcc576ccd6e221f

    • SHA256

      3ffb13019a60f597584feade7356c294ad40b132f5b9faf180c1756b24c4e1a0

    • SHA512

      5ab0e37c0de108afdd3bb94dd9ba2c5279a2238e3125e02d1eea49b8dd191ba647156c15eaa3d422d216a53dcbbacd9ddda360fe2dd4c0895a1474f19a50a1ef

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks