General

  • Target

    237d4aa94739fdee04cd9c86684179d3

  • Size

    1.4MB

  • Sample

    231231-cbjlfshhap

  • MD5

    237d4aa94739fdee04cd9c86684179d3

  • SHA1

    6219d6f61d0b78a60d7f0bdfd20837c0586b0d89

  • SHA256

    a08013695327ad7cb9daa90a7687cb03e6142587903b8198e2edac94fd1672de

  • SHA512

    c0449b6ab12af1bba5fa58f3bfd0d7e67372c847c6aca98508071b8f0e53c24eb12b7a29b7dd93cf119efac23c00ac3577f19518aa88d3dd5ab40a1e9c6da1d2

  • SSDEEP

    24576:/IVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQxYfYnDP2mLSqY:OFA1pvTMbOwa0TmUyMYEh1oCSPnQxYAa

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Targets

    • Target

      237d4aa94739fdee04cd9c86684179d3

    • Size

      1.4MB

    • MD5

      237d4aa94739fdee04cd9c86684179d3

    • SHA1

      6219d6f61d0b78a60d7f0bdfd20837c0586b0d89

    • SHA256

      a08013695327ad7cb9daa90a7687cb03e6142587903b8198e2edac94fd1672de

    • SHA512

      c0449b6ab12af1bba5fa58f3bfd0d7e67372c847c6aca98508071b8f0e53c24eb12b7a29b7dd93cf119efac23c00ac3577f19518aa88d3dd5ab40a1e9c6da1d2

    • SSDEEP

      24576:/IVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQxYfYnDP2mLSqY:OFA1pvTMbOwa0TmUyMYEh1oCSPnQxYAa

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v15

Tasks