Overview

overview

10

Static

static

3

setup_x86_...ll.exe

windows10-2004-x64

10

Resubmissions

11-07-2023 07:32

230711-jc4rcagc6v 10

10-07-2023 13:04

230710-qa9yxabe2z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup_x86_x64_install.bin

  • Size

    14.1MB

  • Sample

    230711-jc4rcagc6v

  • MD5

    aa581b1f07d2ab6bfff3134a307cec2e

  • SHA1

    de449691f3489dd76b891434781b8753802eee14

  • SHA256

    f114cbd90381a13d1f7fee0ff09a52e238a4451da70191a2adeccbf84817c61a

  • SHA512

    b8553eecfa308ac4edbc90c565bfa01bef343ff2842f493e495672fabe11409c437fb07fce6296863b8e8363363a58638f900e6c4f3b06341913004f2f20277d

  • SSDEEP

    196608:J+D/NGZ0gHyb1HMJPD/egwsjWIH4Aihj+avAs4Tt5Q9NCROf2s3Ak:JYNGLHs1wNw6WIHSvvApTyNCROf2s3Ak

Score
10/10
fabookienullmixerredlinesocelars@bobaspackv2dropperinfostealerspywarestealer

Malware Config

Extracted

Family

socelars

C2

http://www.wgqpw.com/

Extracted

Family

redline

Botnet

@Bob

C2

185.215.113.44:23759

Attributes
  • auth_value

    052aa6a199b3b3a78037547a0c15cdcf

Targets

    • Target

      setup_x86_x64_install.bin

    • Size

      14.1MB

    • MD5

      aa581b1f07d2ab6bfff3134a307cec2e

    • SHA1

      de449691f3489dd76b891434781b8753802eee14

    • SHA256

      f114cbd90381a13d1f7fee0ff09a52e238a4451da70191a2adeccbf84817c61a

    • SHA512

      b8553eecfa308ac4edbc90c565bfa01bef343ff2842f493e495672fabe11409c437fb07fce6296863b8e8363363a58638f900e6c4f3b06341913004f2f20277d

    • SSDEEP

      196608:J+D/NGZ0gHyb1HMJPD/egwsjWIH4Aihj+avAs4Tt5Q9NCROf2s3Ak:JYNGLHs1wNw6WIHSvvApTyNCROf2s3Ak

    Score
    10/10
    fabookienullmixerredlinesocelars@bobaspackv2dropperinfostealerspywarestealer

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

      droppernullmixer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars payload

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks