General

  • Target

    fb6dbaf1a03527d3da835cb56e6b4267_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240928-d76ljavenl

  • MD5

    fb6dbaf1a03527d3da835cb56e6b4267

  • SHA1

    6b7b9f20b3d3e3274227524607f2fb13db857f8e

  • SHA256

    6655aea7aaceb1b878caa3d0af776f2a373096e3a9e90b9c53d0b2c3e4d02932

  • SHA512

    eb47d7bbe275799b1055f2856e4340f034296cf6924036cc49250ab526c5bb967c549b2fc08f65d66ea070f53fef62c7f41c87e18d18cc8bef406998ad681828

  • SSDEEP

    49152:2cW4fg5dV56+WGHI2gum5Al98uTB6sSwT:2X4U6f2guXQsSwT

Malware Config

Extracted

Family

socelars

C2

http://www.zhxxjs.pw/Info/

http://www.allinfo.pw/

Targets

    • Target

      fb6dbaf1a03527d3da835cb56e6b4267_JaffaCakes118

    • Size

      1.9MB

    • MD5

      fb6dbaf1a03527d3da835cb56e6b4267

    • SHA1

      6b7b9f20b3d3e3274227524607f2fb13db857f8e

    • SHA256

      6655aea7aaceb1b878caa3d0af776f2a373096e3a9e90b9c53d0b2c3e4d02932

    • SHA512

      eb47d7bbe275799b1055f2856e4340f034296cf6924036cc49250ab526c5bb967c549b2fc08f65d66ea070f53fef62c7f41c87e18d18cc8bef406998ad681828

    • SSDEEP

      49152:2cW4fg5dV56+WGHI2gum5Al98uTB6sSwT:2X4U6f2guXQsSwT

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks