MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc97a6f3209e48c6b45354965214110cc515209135483152672cc73f149cfbcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socelars


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc97a6f3209e48c6b45354965214110cc515209135483152672cc73f149cfbcf
SHA3-384 hash: bd802f51846d98053aeafcdd8aa14701562d1b3d2e18c09bb2ae35732b35655b5fc0aaa5a0929f8ca0b4868cae681793
SHA1 hash: 9f7a4b18bd6cc392651e0582dc22cf12c19d34de
MD5 hash: e5ed0abfd38fb509ef0429dd65318400
humanhash: cup-low-magazine-avocado
File name:file
Download: download sample
Signature Socelars
Create hunting rule
File size:1'296'792 bytes
First seen:2022-12-22 22:11:15 UTC
Last seen:2022-12-22 23:31:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 21b6a4e9054e8bbad032c11f147ef0f3 (3 x LgoogLoader, 1 x ArkeiStealer, 1 x ManusCrypt)
ssdeep 24576:r2hqpk3Zk7VZjAYs2UNdAN0gYXEVeSNuFSOfyylCq81m9Kr:Lgk7V1AYONdU0gIslwSOb9Kr
Threatray 252 similar samples on MalwareBazaar
TLSH T1D3558D6827340DF9D3A1A9321E7866DE50B910A15021A8F6D602F2BE53F7F34FC58F69
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0d0f07092f2e0cc (1 x Socelars, 1 x RedLineStealer)
Reporter jstrosch
Tags:exe signed Socelars

Code Signing Certificate

Organisation:glues.com
Issuer:R3
Algorithm:sha256WithRSAEncryption
Valid from:2022-11-28T06:36:16Z
Valid to:2023-02-26T06:36:15Z
Serial number: 04a495f7cb21dd72e60e737addef21d4421a
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 2e862b0ba82ccecdc4f1901905e2fe8dde4a40680c6d2c9c8b3b7fe185d4e31c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-12-22 22:12:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/28987315-496e-4a5f-bb3a-cc3c02599c7f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/349213/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.179365.8551.6603.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
DNS request
Launching a process
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Forced shutdown of a system process
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63a4d635adc6f57938c5c57e/reports/1932ee80-96e2-44e7-a28d-e3f32f5a4b93/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mustang Panda
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fd0d13cf-3b31-4f0b-9fa7-aca2f5912252
Result
Threat name:
lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1139656
Signature
Allocates memory in foreign processes
Checks if the current machine is a virtual machine (disk enumeration)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected lgoogLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 772386 Sample: file.exe Startdate: 22/12/2022 Architecture: WINDOWS Score: 100 42 Multi AV Scanner detection for dropped file 2->42 44 Yara detected lgoogLoader 2->44 46 Yara detected AntiVM3 2->46 48 2 other signatures 2->48 8 file.exe 19 2->8         started        process3 dnsIp4 34 bitbucket.org 104.192.141.1, 443, 49707, 49709 AMAZON-02US United States 8->34 36 s3-w.us-east-1.amazonaws.com 52.217.33.108, 443, 49708, 49710 AMAZON-02US United States 8->36 38 3 other IPs or domains 8->38 28 C:\Users\user\AppData\Local\...\advapi32.dll, PE32 8->28 dropped 58 Writes to foreign memory regions 8->58 60 Allocates memory in foreign processes 8->60 62 Injects a PE file into a foreign processes 8->62 13 fontview.exe 1 8->13         started        18 ngentask.exe 8->18         started        20 ngentask.exe 8->20         started        file5 signatures6 process7 dnsIp8 40 44software.org 80.76.51.101, 49715, 49717, 49721 CLOUDCOMPUTINGDE Bulgaria 13->40 30 C:\Users\user\AppData\...\nsis_uns1f0dac3.dll, PE32+ 13->30 dropped 64 Query firmware table information (likely to detect VMs) 13->64 66 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 13->66 68 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 13->68 70 4 other signatures 13->70 22 rundll32.exe 13->22         started        file9 signatures10 process11 dnsIp12 32 44software.org 22->32 50 System process connects to network (likely due to code injection or exploit) 22->50 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->52 54 Tries to steal Mail credentials (via file / registry access) 22->54 56 2 other signatures 22->56 26 WerFault.exe 22->26         started        signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc97a6f3209e48c6b45354965214110cc515209135483152672cc73f149cfbcf/
Threat name:
Win32.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-12-22 22:12:08 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3sl2n4zatzemnnctkslfefarbtcrkiergvedcuthftdt6fe47phq._file
Verdict:
malicious
Similar samples:
154ca9b65ed10747abd833a0ea2a7b5135742ea3fdad1f53f006216fc7950ebf
Socelars
2f5adcd21b56b7a72adadb73a7d29ea9158a1b10cf02be624f60f41a3b1fce0d
Socelars
3aa290b067cbd23d42481b61c74ae57834293f9da2e8461e3df6e0629aecb597
Socelars
590420a09891c0a91ecdc29942328e707cc3f0243f5c9907c96150eb15fe1052
Socelars
6b955c6b75fd243f374ffffc38466f94889e3a5ccb3947babf4e79e8358db6fe
Socelars
8028f15755497e60af4f15e0b7171423a5ab31c12b529a0f17807d840665d177
Socelars
9f29109994932960f368925877a9beed7cd6e687686cc8131937e7bbe58384f4
Socelars
c0178dc0e1f125da7b6bab419edc783fdff63a376019140e086e6bc10ec588bd
Socelars
dabdfc50cc2a6bc20b098b7feee83bedf463d58e0a9f824831290acefddc703c
Socelars
e3ac933f39d5fa387a5f844d1d29379d88c4421aa72ac4e9b50d8bc1d5b40fa4
Socelars
+ 242 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/221222-14gvbsfc93/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/31855b36-284c-4239-8e08-b7c695028f03
Unpacked files
SH256 hash:
f3f49752badd4c86beef73ec7e9b30428fabd703d0479ad445f5378fb3369782
MD5 hash:
87a96366806a9ec6e71ead7ab945a886
SHA1 hash:
2d6ba9b4d9893dc22a50fbe7e62d9df5d88cd1c8
Link:
https://www.unpac.me/results/1e73b069-6805-418f-973f-e15016396132/
SH256 hash:
dc97a6f3209e48c6b45354965214110cc515209135483152672cc73f149cfbcf
MD5 hash:
e5ed0abfd38fb509ef0429dd65318400
SHA1 hash:
9f7a4b18bd6cc392651e0582dc22cf12c19d34de
Link:
https://www.unpac.me/results/1e73b069-6805-418f-973f-e15016396132/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dc97a6f3209e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.27
Link:
https://yomi.yoroi.company/submissions/dc97a6f3209e48c6b45354965214110cc515209135483152672cc73f149cfbcf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socelars

Executable exe dc97a6f3209e48c6b45354965214110cc515209135483152672cc73f149cfbcf

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/349213/

Comments