General

  • Target

    63712f0c6f88024d853a47e56512ce0a6eb1e16d7ad7c650df57196040455876

  • Size

    1.4MB

  • Sample

    221025-g4yy3abgb7

  • MD5

    0f1f03c289506776c0b019eda02039c0

  • SHA1

    d86e52c728f5a4dde8cde07e2da3dbb894b35680

  • SHA256

    63712f0c6f88024d853a47e56512ce0a6eb1e16d7ad7c650df57196040455876

  • SHA512

    0a49483ddf823aa7db6d724813eb4c12288299d1ff8efb17ddf9dd0aa457dfe06f469519fffc46e1c1b8b40e5581bce6ea75173353aca45eecca8bd6510726b5

  • SSDEEP

    24576:RJSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjaxOqByO:Rup62ESMTjTPjaoqoO

Malware Config

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sadew1013/

Targets

    • Target

      63712f0c6f88024d853a47e56512ce0a6eb1e16d7ad7c650df57196040455876

    • Size

      1.4MB

    • MD5

      0f1f03c289506776c0b019eda02039c0

    • SHA1

      d86e52c728f5a4dde8cde07e2da3dbb894b35680

    • SHA256

      63712f0c6f88024d853a47e56512ce0a6eb1e16d7ad7c650df57196040455876

    • SHA512

      0a49483ddf823aa7db6d724813eb4c12288299d1ff8efb17ddf9dd0aa457dfe06f469519fffc46e1c1b8b40e5581bce6ea75173353aca45eecca8bd6510726b5

    • SSDEEP

      24576:RJSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjaxOqByO:Rup62ESMTjTPjaoqoO

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks