General

  • Target

    NEAS.aa6a4991054497ef793ad97082145a30.exe

  • Size

    136KB

  • Sample

    231118-ec4zwsad89

  • MD5

    aa6a4991054497ef793ad97082145a30

  • SHA1

    3b7f9223f00a56c4ee387768639f711c372a3ada

  • SHA256

    9a0b1102da969a2c602582e6f8d6783f0f7bd01c08d4d34799f78f49418ba446

  • SHA512

    8a9f2994765c0732df0c37dc85d906fc3391f567deb558198cdc25db29340e7f71715233db6a68d5fd1522e6565e10e62228cdff5e36423fd8305119975ec1f7

  • SSDEEP

    1536:P/oEkqfCZ10zcT9Yh8AIXcjyz9cOXfiXGImcatMrsWjcdf6odgR5AP0:P/5kqCxiXEcO3XfGf2tMUf6odgR5Ac

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Targets

    • Target

      NEAS.aa6a4991054497ef793ad97082145a30.exe

    • Size

      136KB

    • MD5

      aa6a4991054497ef793ad97082145a30

    • SHA1

      3b7f9223f00a56c4ee387768639f711c372a3ada

    • SHA256

      9a0b1102da969a2c602582e6f8d6783f0f7bd01c08d4d34799f78f49418ba446

    • SHA512

      8a9f2994765c0732df0c37dc85d906fc3391f567deb558198cdc25db29340e7f71715233db6a68d5fd1522e6565e10e62228cdff5e36423fd8305119975ec1f7

    • SSDEEP

      1536:P/oEkqfCZ10zcT9Yh8AIXcjyz9cOXfiXGImcatMrsWjcdf6odgR5AP0:P/5kqCxiXEcO3XfGf2tMUf6odgR5Ac

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks