General

  • Target

    841d4bb0280045274535c18cba4e8fa06f1f66d4adedb8a039a9534866a01d14

  • Size

    729KB

  • Sample

    221116-t8pbmscb25

  • MD5

    a4189ce1db140eca8d45b6da16d40f7c

  • SHA1

    d3685a187e7b9d3267d5f6fac298136d4d347dcc

  • SHA256

    739021f63ce519e5e2f70d14f7d2c1044c87d12be0b81ea2178ddabf051ce1b6

  • SHA512

    932fa80828aaa14f6d6015ef9e1024fe4d5761e77596f3d7e91f1ee9b4056dd541e649ec015da0551cc91c3abe124346ca68af6d78e22ed677a8e455c567a769

  • SSDEEP

    12288:J5JXoZhJ9EhG7cEWOlg14A/tL+qzXj/rtdngSbKxk23wIh+PWGU8lH5TSMyUL4U:J5JXWE8vWZ14A/V+qf3gq6bTAPxU8t5R

Malware Config

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/jsdnjd1105/

Targets

    • Target

      841d4bb0280045274535c18cba4e8fa06f1f66d4adedb8a039a9534866a01d14

    • Size

      1.4MB

    • MD5

      f4c919f143c53cfa79256d99ca323a8a

    • SHA1

      68dd896bc52484b2a2ac50c17f943472a2d045ea

    • SHA256

      841d4bb0280045274535c18cba4e8fa06f1f66d4adedb8a039a9534866a01d14

    • SHA512

      924af0cc834a6794766f0a941b17f6f26a0ee3ee13e30aab2cff2bfde2437678561ebab368e2afba71632e26f142e9cdf7f67e59e66cc4e5416583c1df370fe8

    • SSDEEP

      24576:xJSLpwfVWRh0SGQ48Lm2194mKa4qrNkW9NTPjuJDqBH8R:xup62ESMyjTPjuVqBK

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks