General

  • Target

    7cd3e96a1e9d811124f8b445e1565446

  • Size

    1.4MB

  • Sample

    240128-lzkyvsgch5

  • MD5

    7cd3e96a1e9d811124f8b445e1565446

  • SHA1

    0a97d946a451b4c1e5a10b7abd884bf315a5cc44

  • SHA256

    c29bf093ac97b40ae3b83a7a4d0a5e5d5c00057c85da867760804bcc04aa377d

  • SHA512

    6aee7d349dc9fe082c548673bc765ba4012b6071b2ccbc5a22801848e3c3f953c207c79c07ae9f1687b2fb7164d06234a2bfea3a28d670a5af42c96387d49ade

  • SSDEEP

    24576:ZIVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QtYfr0IP:MFA1pvTMbOwa0TmUqMYEOFQOSIsQtYDJ

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Targets

    • Target

      7cd3e96a1e9d811124f8b445e1565446

    • Size

      1.4MB

    • MD5

      7cd3e96a1e9d811124f8b445e1565446

    • SHA1

      0a97d946a451b4c1e5a10b7abd884bf315a5cc44

    • SHA256

      c29bf093ac97b40ae3b83a7a4d0a5e5d5c00057c85da867760804bcc04aa377d

    • SHA512

      6aee7d349dc9fe082c548673bc765ba4012b6071b2ccbc5a22801848e3c3f953c207c79c07ae9f1687b2fb7164d06234a2bfea3a28d670a5af42c96387d49ade

    • SSDEEP

      24576:ZIVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QtYfr0IP:MFA1pvTMbOwa0TmUqMYEOFQOSIsQtYDJ

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v15

Tasks