Extracted

• • Target
    2026-05-04_cf9ee841dd4a302868e451c868fd353f_amadey_coinminer_elex_graphican_luca-stealer_lynx_njrat_socelars
  • Size 1.5MB
  • SHA256 e181f2eb535daafe10c158d73e41b90daecf713abf38539398a2d9906cc928d0
  • MD5 cf9ee841dd4a302868e451c868fd353f
  • SHA1 28a7693b0d614953d3d9e2e8f9b6e7957132acd7
  • SHA512 cd054decf88772451165f7bbb3b1e87860fdd9fca96556d77ff964d9bff95aee040da06021d5885aa1cd4033bcb55403f139801ede0b81d08056771b410bbcc9
  • SSDEEP 49152:4Jtpx1iErFrLK3F7QojUnHo4Sa0ra0b2dPs5O9Gqczr:4hrFzo4nHo4SVr
  • TLSH
    T10E75AE21F7818076E8E301B685FE46BF8D68B631031854D7E3C4189E9E659E27A3F727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverysocelarsspywarestealer

  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Custom signature

    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2