Extracted

• • Target
    2026-05-04_5a4ca1bea2518119c2a385509ff50a46_amadey_coinminer_elex_graphican_luca-stealer_lynx_njrat_socelars
  • Size 1.5MB
  • SHA256 c02d85211ec26be7328abc26216f32318c08a45ed971346a11f4111d71f46a8e
  • MD5 5a4ca1bea2518119c2a385509ff50a46
  • SHA1 1b0e9dd661c3cba59301dea448fe2edce4726eae
  • SHA512 f3ff0f8effaa7aa327941ba755c9156dc8e91c64114a0db6db427ad3f88f9c05c0b12071d680796a19583c4fc9a7cb94930e9cf40dd76b807754583865e9cf61
  • SSDEEP 24576:bIVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QbYfS0IP0kgzgGH:6FA1pvTMbOwa0TmUqMYEOFQOSIsQbY6E
  • TLSH
    T1EA65AF21F6829076F8E301B685FE467F8D68B631031854D7E3C4186E9E649E27A3F727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverysocelarsspywarestealer

  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Custom signature

    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2