Extracted

• • Target
    2026-05-02_6f10173fee282a91232c59bc6938aa75_amadey_coinminer_elex_graphican_luca-stealer_lynx_njrat_socelars
  • Size 4.0MB
  • SHA256 013e34463216a6375207a508781320b45b7040e490883f5df4901f907bd24d04
  • MD5 6f10173fee282a91232c59bc6938aa75
  • SHA1 f39869d30b6b335be25e76801b4b3938afebae44
  • SHA512 313be359a7a6b7a56e9251ff64101fab71b0f8aeff455e5be603e5158c007abb59379497c417fc4557fc7dc60d275a9a88b7ca312f2a9ae240949a2be65227f8
  • SSDEEP 49152:WFA1pvTMbOwa0TmUyMYEh1oCSPnQMYE5P7h5zJh+e/7YnKWyfI+2FlvrcwZS+W5l:oLOwQMLh1oCSMgrp
  • TLSH
    T16D162AA256D848E7E48B173C25F22B2BCD80BB34072555A359C4A8CF9E8DDD7163C7B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverysocelarsspywarestealer

  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2