General

  • Target

    NEAS.b844358cbb8600301a083f41d3de6780.exe

  • Size

    381KB

  • Sample

    231101-rmcdvafa91

  • MD5

    b844358cbb8600301a083f41d3de6780

  • SHA1

    24953b3ee557d9de78c6ab74c44333ec1ff86e8e

  • SHA256

    e12617f50b99a3afd880a1723094ae872e7989d8ac982a1bac3999fe4178c02b

  • SHA512

    a5a83d2be2841772da9962778ffe2ca68fe21d5ed9c11a4b78ed391c925d7f08ef1b0f053faa5bdb5613e057690f43a0c638133f89cd500363e76d69d2293165

  • SSDEEP

    6144:A6wArTEDSCs5wL0Spe5OpvGfnGUtdeHYhZpLkA:AfmQDSCs5woiCOpvmnqH0

Score
10/10

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Targets

    • Target

      NEAS.b844358cbb8600301a083f41d3de6780.exe

    • Size

      381KB

    • MD5

      b844358cbb8600301a083f41d3de6780

    • SHA1

      24953b3ee557d9de78c6ab74c44333ec1ff86e8e

    • SHA256

      e12617f50b99a3afd880a1723094ae872e7989d8ac982a1bac3999fe4178c02b

    • SHA512

      a5a83d2be2841772da9962778ffe2ca68fe21d5ed9c11a4b78ed391c925d7f08ef1b0f053faa5bdb5613e057690f43a0c638133f89cd500363e76d69d2293165

    • SSDEEP

      6144:A6wArTEDSCs5wL0Spe5OpvGfnGUtdeHYhZpLkA:AfmQDSCs5woiCOpvmnqH0

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks