General

  • Target

    aa212a37474c26fd6f680f54fe3ba981

  • Size

    440KB

  • Sample

    240227-zn2zwsbc49

  • MD5

    aa212a37474c26fd6f680f54fe3ba981

  • SHA1

    99c50e471618f3d684b65c4b0b0ed2d3c033aa6b

  • SHA256

    e24825d3376169ea676fc2c6ac644f6560f4026560212598f8e508b0dd5afc35

  • SHA512

    3888396956e3d4895b89fb112cdae44047829ccc97acc7007965f326039fd08e4cbb6666e94d34aa45ab672a9bfae67285b4f4525a13a4928a76b28e98186dc7

  • SSDEEP

    6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGM7:rKf1PyKa2H3hOHOHz9JQ6zBc

Score
10/10

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.165

218.54.31.226

Targets

    • Target

      aa212a37474c26fd6f680f54fe3ba981

    • Size

      440KB

    • MD5

      aa212a37474c26fd6f680f54fe3ba981

    • SHA1

      99c50e471618f3d684b65c4b0b0ed2d3c033aa6b

    • SHA256

      e24825d3376169ea676fc2c6ac644f6560f4026560212598f8e508b0dd5afc35

    • SHA512

      3888396956e3d4895b89fb112cdae44047829ccc97acc7007965f326039fd08e4cbb6666e94d34aa45ab672a9bfae67285b4f4525a13a4928a76b28e98186dc7

    • SSDEEP

      6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGM7:rKf1PyKa2H3hOHOHz9JQ6zBc

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks