General

  • Target

    9192eed4f3433a1fe590754041c0a0cf

  • Size

    1.4MB

  • Sample

    240205-kxgb8acba8

  • MD5

    9192eed4f3433a1fe590754041c0a0cf

  • SHA1

    418b2ced928bda145299323e2e162ccbe2fb4454

  • SHA256

    47d35b344cc8c6ef8e8ae82899655f0f1010d2af4f3c0413e124b9ae94378362

  • SHA512

    6ecf205a5be761f17ed5f32cb820f42752bcab89b8a7916696ef5546e29f9492556e870b1ff8107de0f63447603a0c69535a9fdd6ed7edbf2231dacb21bd61d6

  • SSDEEP

    24576:M8TJtpd95n1HCEei6gFT/L+V3F+kyRejskFL/whBZhnHo4Sad5RKr00z4drPC6ew:jJtpx1iErFrLK3F7QojUnHo4Sa0r00i7

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Targets

    • Target

      9192eed4f3433a1fe590754041c0a0cf

    • Size

      1.4MB

    • MD5

      9192eed4f3433a1fe590754041c0a0cf

    • SHA1

      418b2ced928bda145299323e2e162ccbe2fb4454

    • SHA256

      47d35b344cc8c6ef8e8ae82899655f0f1010d2af4f3c0413e124b9ae94378362

    • SHA512

      6ecf205a5be761f17ed5f32cb820f42752bcab89b8a7916696ef5546e29f9492556e870b1ff8107de0f63447603a0c69535a9fdd6ed7edbf2231dacb21bd61d6

    • SSDEEP

      24576:M8TJtpd95n1HCEei6gFT/L+V3F+kyRejskFL/whBZhnHo4Sad5RKr00z4drPC6ew:jJtpx1iErFrLK3F7QojUnHo4Sa0r00i7

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v15

Tasks