General

  • Target

    dc86d341c68f918577c1260c463de32cdfe07f1ab6bcdb2da73db12d8cf9cae4

  • Size

    675KB

  • Sample

    221229-jv6zesff9s

  • MD5

    e8d91c44303466601299576763e776a6

  • SHA1

    c2c9227e610b5b269b726a0a74cb5f4622df1ed4

  • SHA256

    dc86d341c68f918577c1260c463de32cdfe07f1ab6bcdb2da73db12d8cf9cae4

  • SHA512

    3f985a06f4a149f68c0ee0e1391e607ec1a3d90613c1378275fbeb0fee5b7776b99bd8c5fd099fa358eb0b20e919544ccb389dc299e657150a9fe5b871ad3bd0

  • SSDEEP

    12288:4E1M9Vh3xscEe7b1QfOy6zNM1lPHmVVbvwhlXf5/hzrYEQOq6:dM9DQQyD1lPH0V7ulXxxU

Malware Config

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/sadffew26/

Targets

    • Target

      dc86d341c68f918577c1260c463de32cdfe07f1ab6bcdb2da73db12d8cf9cae4

    • Size

      675KB

    • MD5

      e8d91c44303466601299576763e776a6

    • SHA1

      c2c9227e610b5b269b726a0a74cb5f4622df1ed4

    • SHA256

      dc86d341c68f918577c1260c463de32cdfe07f1ab6bcdb2da73db12d8cf9cae4

    • SHA512

      3f985a06f4a149f68c0ee0e1391e607ec1a3d90613c1378275fbeb0fee5b7776b99bd8c5fd099fa358eb0b20e919544ccb389dc299e657150a9fe5b871ad3bd0

    • SSDEEP

      12288:4E1M9Vh3xscEe7b1QfOy6zNM1lPHmVVbvwhlXf5/hzrYEQOq6:dM9DQQyD1lPH0V7ulXxxU

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks