MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socelars


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c
SHA3-384 hash: f8c8e8d40659048a890eb5c6fd60c5724d0ffaf5cab6b0b90910620abb5760c66f748f6cdc0e32a372b7ee0bbfeeb7e2
SHA1 hash: 4b42db8af96b19c890fb47d494983da9dbff6090
MD5 hash: 55694841ce219e189883689911ee9291
humanhash: lactose-vermont-yellow-oxygen
File name:0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c
Download: download sample
Signature Socelars
Create hunting rule
File size:6'006'682 bytes
First seen:2022-03-17 05:45:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep 98304:xomZIRFJvSXKBCC8Yw81+b2R0fRfwG2pwMCnVIlanmf1dxreY16nz8kxWhbU96BP:xom2RzvJCC8p8MaOfRfwJcVIl59PreYv
Threatray 6'841 similar samples on MalwareBazaar
TLSH T1505633E536F990FBE5612A74759A2BA9A5FB131C0535C53302CBBC0CBF9D94660AFC02
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter JAMESWT_WT
Tags:exe hhiuew33-com Socelars

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c
Verdict:
No threats detected
Analysis date:
2022-03-17 06:17:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7ab3d0f6-2d42-4e05-ad8b-b2b553e4d8b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLInjector03
Create hunting rule
Link:
https://www.capesandbox.com/analysis/251734/
Detection(s):
Win.Dropper.Pswtool-9857487-0
Create hunting rule

Win.Dropper.Pswtool-9857535-0
Create hunting rule

Win.Packed.Barys-9859263-0
Create hunting rule

Win.Malware.Barys-9859499-0
Create hunting rule

Win.Packed.Barys-9859531-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Searching for the window
Running batch commands
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/9522/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6232caf3dfdfa8501cade609/reports/3cad84aa-39d1-4d10-9bc8-64565952adc6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/142fc87b-b51e-4b69-a24f-09c9ce62403d
Result
Threat name:
RedLine SmokeLoader Socelars onlyLogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/958467
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file has a writeable .text section
Sample uses process hollowing technique
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Yara detected onlyLogger
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Socelars
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 590948 Sample: X6vZL6Tj7s Startdate: 17/03/2022 Architecture: WINDOWS Score: 100 63 80.71.158.106 PARKNET-ASDK unknown 2->63 65 ip-api.com 208.95.112.1, 49774, 80 TUT-ASUS United States 2->65 67 19 other IPs or domains 2->67 69 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus detection for URL or domain 2->73 75 14 other signatures 2->75 10 X6vZL6Tj7s.exe 21 2->10         started        signatures3 process4 file5 49 C:\Users\user\AppData\...\setup_install.exe, PE32 10->49 dropped 51 C:\Users\...\621c881e830e2_Mon0836df042.exe, PE32 10->51 dropped 53 C:\...\621c881e3ad54_Mon08ae77cf9858.exe, PE32 10->53 dropped 55 16 other files (11 malicious) 10->55 dropped 13 setup_install.exe 1 10->13         started        process6 signatures7 105 Adds a directory exclusion to Windows Defender 13->105 16 cmd.exe 13->16         started        18 cmd.exe 1 13->18         started        20 cmd.exe 1 13->20         started        22 8 other processes 13->22 process8 signatures9 25 621c881727dea_Mon08aa5bfb341.exe 16->25         started        28 621c880ea5683_Mon08edc6794e.exe 3 18->28         started        30 621c880aa1b5b_Mon08724d0c.exe 1 20->30         started        77 Adds a directory exclusion to Windows Defender 22->77 79 Disables Windows Defender (via service or powershell) 22->79 32 621c8811673ea_Mon08f0e21e7.exe 12 22->32         started        35 621c8815874b8_Mon08f9600153f.exe 22->35         started        38 621c881218d31_Mon08b676c70.exe 1 22->38         started        40 3 other processes 22->40 process10 dnsIp11 81 Antivirus detection for dropped file 25->81 83 Multi AV Scanner detection for dropped file 25->83 85 Detected unpacking (changes PE section rights) 25->85 99 4 other signatures 25->99 87 Machine Learning detection for dropped file 28->87 89 Writes to foreign memory regions 28->89 91 Allocates memory in foreign processes 28->91 101 2 other signatures 28->101 93 Disables Windows Defender (via service or powershell) 30->93 42 cmd.exe 30->42         started        57 iplogger.org 148.251.234.83, 443, 49771 HETZNER-ASDE Germany 32->57 59 www.icodeps.com 149.28.253.196, 443, 49769 AS-CHOOPAUS United States 32->59 95 May check the online IP address of the machine 32->95 45 C:\Users\...\621c8815874b8_Mon08f9600153f.tmp, PE32 35->45 dropped 97 Obfuscated command line found 35->97 61 onenew-cloudapps.com 188.114.96.7, 49770, 80 CLOUDFLARENETUS European Union 40->61 47 C:\Users\user\AppData\Local\...\alqqHIC.mhf, PE32 40->47 dropped file12 signatures13 process14 signatures15 103 Disables Windows Defender (via service or powershell) 42->103
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-02 19:18:45 UTC
File Type:
PE (Exe)
Extracted files:
366
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
022e85b0301517e90423006b4ea98ace33f914820228f0e5f2fab9d66219ac98
Socelars
0608db47a51634204b29ea7e166c28e039721eefc409173f804fb2c488440e72
Socelars
2a9103251afe0c1ef6438869cd7f2ab6a9cd3ba724d527bd41dc58834a800256
Socelars
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
Socelars
4eebc9db13bf3a2bbae7f56ecdb4be388610bff9cdb4931f9d776762597286a6
Socelars
523c3d9d49ff39f7f97331e9d89c18053ab85c80f2ead0b505cc7e27e7aa2fcd
Socelars
8a8ed9f1dbe9f72dd7f60806be5130daf6148443a45d6c20d1449a4e490837c9
Socelars
a8608c25f43dcab1c8501cb89b796d75b94a0abd260d3cee39a7e56e889326d6
Socelars
+ 6'831 additional samples on MalwareBazaar
Result
Malware family:
socelars
Create hunting rule
Score:
  10/10
Tags:
family:onlylogger family:redline family:smokeloader family:socelars botnet:media24225 botnet:vnew2 aspackv2 backdoor discovery infostealer loader spyware stealer suricata trojan upx
Link:
https://tria.ge/reports/220317-gfsgdahhgp/
Behaviour
Checks SCSI registry key(s)
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Executes dropped EXE
UPX packed file
OnlyLogger Payload
Socelars Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE MSIL/TrojanDownloader.Agent.JVN CnC Checkin
OnlyLogger
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Socelars
Malware Config
C2 Extraction:
https://frertge.s3.eu-west-2.amazonaws.com/asdhbf/
http://host-data-coin-11.com/
http://file-coin-host-12.com/
92.255.57.154:11841
116.203.252.195:11112
Unpacked files
SH256 hash:
245a869dc8a9bcb2190b5da3ea234740d79798385784e8db7aa3f2d2745192aa
MD5 hash:
4f93004835598b36011104e6f25dbdba
SHA1 hash:
6cb45092356c54f68d26f959e4a05ce80ef28483
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
721d393191597d49d856baef2fbde75e48f52d0465e2cfabf1a41848b0e05589
MD5 hash:
b984a027c8a2abf874f3eb306a831613
SHA1 hash:
d3b3f8890adc840b0bd411cf304eef15d415ed48
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
Parent samples :
fb9b41efdc7c2d9e8cfda4be223831a9d2f4d21366759da64e04bbbb9e662766
bc9d49f4f0d51c57b34515616d5e6a23a37fec03f8884d8305db0806bd6138fc
ecb96fec4db4a1eecef04c8ef12b260bb419407111c1263664749481b7fa5387
98c920233869ce802fb4722f982fc1a8c2461e2a01ea4a619a9532a660acf285
2fde1682e006e27b2deb49595ab3baf37a836577fbe9efdfae59d4b6b682d8b7
2374069183727dd5904a26027c80032f30dcff60d25019578876c0b37fa9c224
bd3030832602591f05fe01ef11feaa3b9fe776b2a184eb454f02cae3ab73340b
a0f15f4665835bb7f3b07d5e96d2b08af8e88614c9b22fc9fff86f4f60ee1a8e
c91dec1cd5b97079481c76d5d597dde67b60c301ea900eab7db99776d52b465a
SH256 hash:
e16f68152fa7be7dd8aff55aeff59ddeae48b4b95e3d3ba33016f65e632a6706
MD5 hash:
a8e7034f8220f722f4aca2edcc9c42eb
SHA1 hash:
656d7d88fffd3820deb1741564807990c3851114
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
b6b2ade3c97669a1eee58fdb3aaacdb63c31f737242e3ad21f55503a8743bacc
MD5 hash:
fadb35ad1ad1d26549b1f8aa1ae3178c
SHA1 hash:
347b1d2523d5ec46fc736a2ee68e1a51ea299b2a
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
756eabb5cd8ff2d5e9c99d92bdcac68b9df69b7a220a01bd72a90b9c94bcb597
MD5 hash:
d66372b02db2aae4902f1dff045f6b7c
SHA1 hash:
5d501b447043bdff2de8bf092f063fd03c3cf6f3
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
7cb44671c2b4bb56f99cde175d969c903a58bbf06104e8ad456419761f264821
MD5 hash:
b653343e5c701720bb92ed19abef4f81
SHA1 hash:
968602dd34add2a908cb07b382438c9e5c131d16
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
e718a2f50e72d94ee2c9455603d98f67e7705aefc283351c182b5e503d59f6d8
MD5 hash:
5264c8567cf762e7cd37971a88b28a45
SHA1 hash:
ffd23a453665086713bbeccf0029c5b026d4c47e
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
0905e503bbd1b44298fbd25edd73928d8420f562484d78ef4eedfbda662c9d4c
MD5 hash:
74f2f7d9a140d455630cfd3e1ab5d3b0
SHA1 hash:
8efa0f403f6a1ef8766b70e33e7fe22e6e4a77bd
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
79fdae8cd42b8bab3280b4b253e800594415d81fdee1d0a4333eca04bc60c78d
MD5 hash:
22d245b66d4f548d414103be37257053
SHA1 hash:
60bc4e063440e6cfb88db37012c38502eb4e63a6
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
8e2a9d3dc7412215c3eb1916dedb7e822059db80282d2f70b8262464077d4919
MD5 hash:
2aa264eb38e19221322155c2e65c97d8
SHA1 hash:
3381da98bc42b58274e06d1b72a32eee721175f7
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
abca3ef4971ea9cf196e429902da91fb3f0db2b502ed8dbe33bee639bb4d0b2c
MD5 hash:
e63b0af4990bdfb854b09570164175e1
SHA1 hash:
2363fd653143e88f92e8bc388d7cc5ed28e66ac2
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
d9f482d843635c8b747bef2ceb43167ed7e15a4e4939054a7e6354cdf1cf7b0e
MD5 hash:
57bade7e373b8bd3ed607c0c0d30637b
SHA1 hash:
184c9c693021346ea8da800c2045aca4cf4029b7
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
69b3902468ca70c2e2ad93559482d009fbc7cba297e596214ad4098450652109
MD5 hash:
090d2c6c392af6688e3f4c13069764a8
SHA1 hash:
0caec60eb68f108868805d426cfa8693f5c4e36f
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
565cb30a640d5cb469f9d93c969aab083fa14dfdf983411c132927665531795c
MD5 hash:
83b531c1515044f8241cd9627fbfbe86
SHA1 hash:
d2f7096e18531abb963fc9af7ecc543641570ac8
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
5564917454238120124cbf40dc0bb4c0cf6d2ac556df98cfbab50f63b1f45e1b
MD5 hash:
6e80509d2f183ca2ec88248c8e69bf42
SHA1 hash:
5a8755924f95709c78ffd51fc2dd1334c8614b6e
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
0ffe8af65c2a3ae624be5c133e00a386469678f5630934dace0455866c81dad2
MD5 hash:
438b63a2c1f57ca9e4256cb10d9ac7fb
SHA1 hash:
3eabd35111d92560b210c83a192beaaca174c129
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
7e41b212ab73b0c25ed7f00a023703d4bfb5c4f0182857bd2c8b11a26e437591
MD5 hash:
6652ebc17b68c3bea4cf8e5bc6a713eb
SHA1 hash:
a421bffe24bee2b9eb9a994aa8ceedafbbc278d7
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
cf068cfb6e58abd2e2ffae06b6a44856a51be850419f5feb1474df306124a487
MD5 hash:
7866a423d6854e07cd928940f32cf29e
SHA1 hash:
e394566fde3341c269572d6197fd49e0c2e9dee7
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
78e9e8c1d9c6e8e8b298812fbe18755dfa429d94e616aaed08cda42b5985f345
MD5 hash:
c658b6942919f0ac3548940b5321ee64
SHA1 hash:
47aca6763fbedeedd7c02f63c57e3d293aa69da7
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
fa4cfc21b069a8577c0eefa4b7869cdf8389ad061992efc91b908031ef1990fb
MD5 hash:
7c51e6fea3ca8f884cbd8017d02913b7
SHA1 hash:
2087c09b2a331131cff1b1e77e41eb8616465725
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
1316fdff6e309c5fc5a90bed2e25cf96c1581fc9fa72157fd28d9dbb15ce4ba4
MD5 hash:
79b3d2297d66a3adbaf4221645fec748
SHA1 hash:
0b458c0795e6b7fb8becf4dc6848a200c0fa846e
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
SH256 hash:
0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c
MD5 hash:
55694841ce219e189883689911ee9291
SHA1 hash:
4b42db8af96b19c890fb47d494983da9dbff6090
Link:
https://www.unpac.me/results/dcb7dd50-20d1-4e37-85b7-ef155734ad67/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/251734/

Comments