MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6e4ea20b713160991d914e95be1e100144275700d4f5552db40d58292fca9854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Socelars
Vendor detections: 13
| SHA256 hash: | 6e4ea20b713160991d914e95be1e100144275700d4f5552db40d58292fca9854 |
|---|---|
| SHA3-384 hash: | 2532924a2acf5929edc436f7786eed1fe1a060c270a4b9769a57ff5c9d94fe4e2229305231cb9b89bec41551f7849fb1 |
| SHA1 hash: | 280413810800f3488458a4af04b95703a36d8e38 |
| MD5 hash: | d9e55d6af8971f24c6318e8c4ced1508 |
| humanhash: | december-undress-july-triple |
| File name: | DiskProtect6FFFDCF3.exe |
| Download: | download sample |
| Signature | Socelars |
| File size: | 890'434 bytes |
| First seen: | 2022-03-24 21:11:25 UTC |
| Last seen: | 2022-03-24 22:54:16 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2fb819a19fe4dee5c03e8c6a79342f79 (56 x Adware.InstallCore, 8 x RedLineStealer, 7 x Adware.ExtenBro) |
| ssdeep | 12288:ZyIFQqB+mAMhHipvTct7pRPMD1sjze+hZMEAgMp7/jmQsXCscpJTrKCUFO+:ZyIHB+mnSAt7XPO1QhuEAb/S1XsJvZR+ |
| Threatray | 68 similar samples on MalwareBazaar |
| TLSH | T10815221AB681D532D02086F87CB7D670177B7F417D702242BA2CBB9E6F3B621781A316 |
| File icon (PE): |  |
| dhash icon | 71f0b8b8b098e060 (1 x Socelars) |
| Reporter |  adm1n_usa32 |
| Tags: | exe Socelars |
Intelligence
File Origin
# of uploads :
2
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DiskProtect6FFFDCF3.exe
Verdict:
Suspicious activity
Analysis date:
2022-03-24 21:10:40 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Moving a recently created file
Modifying a system file
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Creating a file in the Windows subdirectories
Launching a process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
control.exe greyware overlay packed setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Verdict:
Malicious
Result
Threat name:
Socelars
Detection:
malicious
Classification:
troj
Score:
96 / 100
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Yara detected Socelars
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.Socelars
Status:
Malicious
First seen:
2019-05-20 10:38:07 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
25 of 42 (59.52%)
Threat level:
2/5
Verdict:
malicious
Similar samples:
+ 58 additional samples on MalwareBazaar
Result
Malware family:
socelars
Score:
10/10
Tags:
family:socelars discovery stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Socelars
Malware Config
C2 Extraction:
http://www.sblinfo.pw/index.php/
Unpacked files
SH256 hash:
8e925865a6404fb650d212a2983585a28b1bd2a3ff768625c955c175aafe89a8
MD5 hash:
1bb4bc70e57b1fcf9089f5c5e1eb1898
SHA1 hash:
3f03b64280353fcb9bee582921d03afe1bbf8a6a
Detections:
win_socelars_auto
SH256 hash:
d34dc3d80a0de45b0c4d2d463767882bd2ed97912d7cf0424d2004121804bb6f
MD5 hash:
fc777972bdfd90900501d60f13abb003
SHA1 hash:
8191ff0950336583410169ff56826317820691ec
SH256 hash:
6e4ea20b713160991d914e95be1e100144275700d4f5552db40d58292fca9854
MD5 hash:
d9e55d6af8971f24c6318e8c4ced1508
SHA1 hash:
280413810800f3488458a4af04b95703a36d8e38
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.