MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a094aaf3ad7223f8f98bd6d179ec083c879cfa59a2a719e7f3ba463a7341e61e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Socelars

Vendor detections: 14

Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash:	a094aaf3ad7223f8f98bd6d179ec083c879cfa59a2a719e7f3ba463a7341e61e
SHA3-384 hash:	2b7107a2fd18917647398b9226cdb814a003332fd5725035402ff8308aaffcc68ab8b0fef8ac8f2f0e6bc9e7909d6141
SHA1 hash:	aa8cbdd47e3e233c6fccc074be86c12aa1253cf3
MD5 hash:	da86303e40ee7598b421fbe7b5029e6b
humanhash:	jersey-steak-fifteen-zulu
File name:	da86303e40ee7598b421fbe7b5029e6b.exe
Download:	download sample
Signature	Socelars Create hunting rule
File size:	1'508'864 bytes
First seen:	2023-05-15 14:44:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b1e867ef87efb215fbaa4877aa8fac3e (93 x Socelars, 1 x SocGholish)
ssdeep	24576:qVYkTpy0OVnKhXJ04BJFKA3wRKB7a9WscrmCqeQrEXl5hKtOW:epJOl8xFMRy/SeQg15wwW
Threatray	67 similar samples on MalwareBazaar
TLSH	T182658D21F7C26032E8E310B745FF66BE8D3C6A11470894D7D3C81D99AB615E27A3B61B
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	00ececd0d4d6c400 (4 x Socelars)
Reporter	abuse_ch
Tags:	exe Socelars

Intelligence

File Origin

# of uploads :

# of downloads :

270

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

da86303e40ee7598b421fbe7b5029e6b.exe

Verdict:

Malicious activity

Analysis date:

2023-05-15 14:45:28 UTC

Tags:

evasion

Link:

https://app.any.run/tasks/4e66b9d0-978b-4daf-95a8-13a2da7f0b3b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/390200/

Detection(s):

SecuriteInfo.com.Trojan.Siggen19.56605.3665.14367.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Creating a file in the Program Files subdirectories

Changing a file

Creating a window

Creating a file in the %temp% directory

Reading critical registry keys

Sending a UDP request

Creating a file

Searching for synchronization primitives

Unauthorized injection to a recently created process

Replacing files

Moving a recently created file

Launching a tool to kill processes

Stealing user critical data

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/84712/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

88%

Tags:

cmd.exe evasive exploit explorer.exe fingerprint greyware packed shell32.dll spybanker

Link:

https://www.filescan.io/uploads/6462457518c2b9a49ad24d6a/reports/f318b8d2-a3a6-4e97-a720-0bc75d8948b0/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/a094aaf3ad7223f8f98bd6d179ec083c879cfa59a2a719e7f3ba463a7341e61e

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Socelars

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/241ef84b-0086-401c-a6e7-9532e38b070b

Result

Threat name:

Socelars

Detection:

malicious

Classification:

troj.expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1233862

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Socelars

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a094aaf3ad7223f8f98bd6d179ec083c879cfa59a2a719e7f3ba463a7341e61e/

Threat name:

Win32.Trojan.Redlinestealer

Status:

Malicious

First seen:

2023-05-15 14:45:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 37 (70.27%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uckkv45noir7r6ml23ixt3aihsdzz6szuktrtz7txjddu42b4ypa._file

Verdict:

malicious

Socelars

6eb28920cd3e8d50c66e39e7aa042b22dd05d17c2a62817113d76e5df2732fd8

Socelars

70884c8d9309d5523f92484e6b72c3e4230cde617dffc6d355880f408f00aade

Socelars

93ed888d096a671d7e928940412daed26f5648522d992d415c00598153f96545

Socelars

a29e436e7e209a545f314516f58fef84718871270da8b5c4aede7048b8ee0c31

Socelars

ad4e0ba259ac824927b62d57198492fa94c8268f3000432a7fdf727bf67de797

Socelars

c6c1a3544e572b61cfff02845b9f729f78621e7cd6d3a5a753406050bbf86e03

Socelars

d7140018b6ca4711fc2630b815d6aa869dcf472b12ae67d588738eba1765633b

Socelars

+ 57 additional samples on MalwareBazaar

Result

Malware family:

socelars

Score:

10/10

Tags:

family:socelars spyware stealer

Link:

https://tria.ge/reports/230515-r4qmssfh55/

Behaviour

Enumerates system info in registry

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops Chrome extension

Legitimate hosting services abused for malware hosting/C2

Reads user/profile data of web browsers

Malware Config

C2 Extraction:

https://hdbywe.s3.us-west-2.amazonaws.com/uysf428/

Unpacked files

SH256 hash:

a094aaf3ad7223f8f98bd6d179ec083c879cfa59a2a719e7f3ba463a7341e61e

MD5 hash:

da86303e40ee7598b421fbe7b5029e6b

SHA1 hash:

aa8cbdd47e3e233c6fccc074be86c12aa1253cf3

Detections:

Socelars

Link:

https://www.unpac.me/results/e8bde927-2bf0-43fe-9ec8-1d9ebfa5b911/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Sandworm_ArguePatch_Apr_2022_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:	https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	Socelars_bin Create hunting rule
Author:	James_inthe_box
Description:	Socelars stealer
Reference:	https://app.any.run/tasks/6cd9a083-44e6-48e2-9c21-355c35cb9a57