General

  • Target

    ff15e54a0d61815cc81f70724b5114553c4bf92fc99abc48f5ad6915ddf9d369

  • Size

    968KB

  • Sample

    220912-n8lymaghhl

  • MD5

    15993c2f3517255995d1c94acd30cc6f

  • SHA1

    f4ca4f94dccc8b5fdb39d33859ba94d5ee102a7a

  • SHA256

    ff15e54a0d61815cc81f70724b5114553c4bf92fc99abc48f5ad6915ddf9d369

  • SHA512

    a3bef166e5284d125a4ade1c1d3e121df42b34bdbc75a271e16f9c84755719f18ba73fdb7248c5d7f1c807c67ebe6a35aa5ca4630a3d30c20d34b6796d0e7988

  • SSDEEP

    24576:CHNN4V6SVTmVbZ0xXaxYpOebNIfAiCub3Z:CHtSIqXaSpOeRIoiCo

Malware Config

Extracted

Family

socelars

C2

https://dfgrthres.s3.eu-west-3.amazonaws.com/asdhs909/

Targets

    • Target

      ff15e54a0d61815cc81f70724b5114553c4bf92fc99abc48f5ad6915ddf9d369

    • Size

      968KB

    • MD5

      15993c2f3517255995d1c94acd30cc6f

    • SHA1

      f4ca4f94dccc8b5fdb39d33859ba94d5ee102a7a

    • SHA256

      ff15e54a0d61815cc81f70724b5114553c4bf92fc99abc48f5ad6915ddf9d369

    • SHA512

      a3bef166e5284d125a4ade1c1d3e121df42b34bdbc75a271e16f9c84755719f18ba73fdb7248c5d7f1c807c67ebe6a35aa5ca4630a3d30c20d34b6796d0e7988

    • SSDEEP

      24576:CHNN4V6SVTmVbZ0xXaxYpOebNIfAiCub3Z:CHtSIqXaSpOeRIoiCo

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks