General

  • Target

    30a2d83678b8e9a39debd957bf3e4dea8d97423fe19ca7b21a87ff1434f9b3d3

  • Size

    675KB

  • Sample

    220908-hkleasdhd2

  • MD5

    1209eb5280434f121fa888e5d9665bef

  • SHA1

    d85f7e6ab0486f32bc51c772215488dcfb299941

  • SHA256

    30a2d83678b8e9a39debd957bf3e4dea8d97423fe19ca7b21a87ff1434f9b3d3

  • SHA512

    79cdf89289871b1a89b65bb36353437d4c2fa11fb0bc6a4c60affc43ad1eab6d836c17a9a0bccdbaff365713b508b130af9eda338acb08d03af8fad0a1fa5c9b

  • SSDEEP

    12288:34wymABpXFdYopRyqUoeGN+t3+y8diXIpjD5nCypNxXdhMFM3ljsJ5FaKyz4M0yh:VbOpXIoOaI9+NdiYpXBCyrxXsMJo4X4s

Malware Config

Extracted

Family

socelars

C2

https://hueduy.s3.eu-west-1.amazonaws.com/dhfry901/

Targets

    • Target

      30a2d83678b8e9a39debd957bf3e4dea8d97423fe19ca7b21a87ff1434f9b3d3

    • Size

      675KB

    • MD5

      1209eb5280434f121fa888e5d9665bef

    • SHA1

      d85f7e6ab0486f32bc51c772215488dcfb299941

    • SHA256

      30a2d83678b8e9a39debd957bf3e4dea8d97423fe19ca7b21a87ff1434f9b3d3

    • SHA512

      79cdf89289871b1a89b65bb36353437d4c2fa11fb0bc6a4c60affc43ad1eab6d836c17a9a0bccdbaff365713b508b130af9eda338acb08d03af8fad0a1fa5c9b

    • SSDEEP

      12288:34wymABpXFdYopRyqUoeGN+t3+y8diXIpjD5nCypNxXdhMFM3ljsJ5FaKyz4M0yh:VbOpXIoOaI9+NdiYpXBCyrxXsMJo4X4s

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks