urelas | ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb

Sharing

Copy URL Twitter E-mail

General

Target
ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb
Size 417KB
Sample240305-cs4mysbh4s
SHA256 ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb
MD5 5323d5a77f6ce194a9023df2dccd6d19
SHA1 0a611ca0a52faedeca469c32d4e6d07365dcf373
SHA512 523bfafe538e7bd8499cfed1a97963878e726e582b75180124cb18fb8678504fa1417ab746621ca83971c3f8860212ba294021a08bc2bb40de6ee4832dc23544
SSDEEP 6144:kzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOYqD:eU7M5ijWh0XOW4sEfeObD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb

File Explorer

ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb

.exe 417KB

ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb
MD5 5323d5a77f6ce194a9023df2dccd6d19
SHA1 0a611ca0a52faedeca469c32d4e6d07365dcf373
SHA512 523bfafe538e7bd8499cfed1a97963878e726e582b75180124cb18fb8678504fa1417ab746621ca83971c3f8860212ba294021a08bc2bb40de6ee4832dc23544
SSDEEP 6144:kzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOYqD:eU7M5ijWh0XOW4sEfeObD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification