General

  • Target

    fbb96922c063a20bb24fbddd4792889017bffdec869b6948707fe54d11f25d65

  • Size

    968KB

  • Sample

    220912-nqfznaghep

  • MD5

    55c63048b4c041a719d52c9a5062424f

  • SHA1

    0588700e245281b758b57fff856bac74dd8cbea7

  • SHA256

    fbb96922c063a20bb24fbddd4792889017bffdec869b6948707fe54d11f25d65

  • SHA512

    89a96a20ac9ffdc6c549e39b1ae6b9df2e43f089747d827987bf2d473884651ca0edf918412235eb569a6db0e7002eaf8fb3569258c94e62dc327fc49bcad284

  • SSDEEP

    24576:UHNN4V6SVTmVbZ0xXaxYpOebNIfAznb2:UHtSIqXaSpOeRIozb

Malware Config

Extracted

Family

socelars

C2

https://dfgrthres.s3.eu-west-3.amazonaws.com/asdhs909/

Targets

    • Target

      fbb96922c063a20bb24fbddd4792889017bffdec869b6948707fe54d11f25d65

    • Size

      968KB

    • MD5

      55c63048b4c041a719d52c9a5062424f

    • SHA1

      0588700e245281b758b57fff856bac74dd8cbea7

    • SHA256

      fbb96922c063a20bb24fbddd4792889017bffdec869b6948707fe54d11f25d65

    • SHA512

      89a96a20ac9ffdc6c549e39b1ae6b9df2e43f089747d827987bf2d473884651ca0edf918412235eb569a6db0e7002eaf8fb3569258c94e62dc327fc49bcad284

    • SSDEEP

      24576:UHNN4V6SVTmVbZ0xXaxYpOebNIfAznb2:UHtSIqXaSpOeRIozb

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks