urelas | ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c

Sharing

Copy URL Twitter E-mail

General

Target
ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c
Size 433KB
Sample240302-ds834shd8t
SHA256 ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c
MD5 1cb281d7ea6b3611ffe2e759a3b82ada
SHA1 59e26a5bf7657290bf423fb8709d60a8116df71f
SHA512 141c4f99a97a3221b0f7b22a59877a9db7a0f03fb67e704cd9476022f5df0386e67c329411443c5a2422d1b4b3b446430d553a61f58035c119c4df6c3bf8ba4e
SSDEEP 6144:DKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fk5T:OANxU3VH1t19MsAlpXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c

File Explorer

ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c

.exe 433KB

ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c

IMPHASH ccb1fd1fca498ed2aa99d7e0f38d82b7
SHA256 ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c
MD5 1cb281d7ea6b3611ffe2e759a3b82ada
SHA1 59e26a5bf7657290bf423fb8709d60a8116df71f
SHA512 141c4f99a97a3221b0f7b22a59877a9db7a0f03fb67e704cd9476022f5df0386e67c329411443c5a2422d1b4b3b446430d553a61f58035c119c4df6c3bf8ba4e
SSDEEP 6144:DKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fk5T:OANxU3VH1t19MsAlpXh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12809

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification