Behavioral task
behavioral1
Sample
6b4f3a668a9a2f7ccfdbcf47b207c0c27ef5645657e1f3fdf92acde86b28bc26.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6b4f3a668a9a2f7ccfdbcf47b207c0c27ef5645657e1f3fdf92acde86b28bc26.exe
Resource
win10v2004-20230703-en
General
-
Target
6b4f3a668a9a2f7ccfdbcf47b207c0c27ef5645657e1f3fdf92acde86b28bc26
-
Size
697KB
-
MD5
3b88ad585861a80c585f0b5050e951dd
-
SHA1
61da900eebdbf4d8a73f7ecb976ea34cc1f146ea
-
SHA256
6b4f3a668a9a2f7ccfdbcf47b207c0c27ef5645657e1f3fdf92acde86b28bc26
-
SHA512
3e113887499b9f294de27c65c3fa30742ca8ab454733586f69d5d53d96f01e0c7adc12cf79120953936ec9f9bb189bc8d0485ce6eb099c81f6312d88f71dae9f
-
SSDEEP
12288:yKujDvTFfmvdFHvQ6XRLdxhgbRo4Kfoe5l3yk:XuHvQzHvpxiRKf3l3yk
Malware Config
Extracted
socelars
http://www.wygexde.xyz/
Signatures
-
Socelars family
-
Socelars payload 1 IoCs
resource yara_rule sample family_socelars -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b4f3a668a9a2f7ccfdbcf47b207c0c27ef5645657e1f3fdf92acde86b28bc26
Files
-
6b4f3a668a9a2f7ccfdbcf47b207c0c27ef5645657e1f3fdf92acde86b28bc26.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 912KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 603KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE