urelas | c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212

Sharing

Copy URL Twitter E-mail

General

Target
c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212
Size 420KB
Sample240302-brw12sge32
SHA256 c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212
MD5 a24d7d0130efe55382c8210712dee69b
SHA1 254414bdb5b5b399e683ebeccd375375ad0d9a6e
SHA512 b55d7cf833e4f745c37abd3d47db14afd428443100daca859bfd99b7f1a12beec4e3e010b063336d748b86a9139f12b29d14fc00ff4703a756d413733b5e812b
SSDEEP 6144:UzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODGM:uU7M5ijWh0XOW4sEfeOn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212

File Explorer

c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212

.exe 420KB

c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212
MD5 a24d7d0130efe55382c8210712dee69b
SHA1 254414bdb5b5b399e683ebeccd375375ad0d9a6e
SHA512 b55d7cf833e4f745c37abd3d47db14afd428443100daca859bfd99b7f1a12beec4e3e010b063336d748b86a9139f12b29d14fc00ff4703a756d413733b5e812b
SSDEEP 6144:UzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODGM:uU7M5ijWh0XOW4sEfeOn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification