urelas | e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf

Sharing

Copy URL Twitter E-mail

General

Target
e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf
Size 445KB
Sample240310-bybcxshb31
SHA256 e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf
MD5 3f032cb7c4611688a2ed93132db128ea
SHA1 b5635ace9c98d50756b318f9a6c687d5846e2604
SHA512 c6ee2235bc5a64a71642ac5a4fbea72bfa9bcaee57cfc49ce3543f603c86314c7cac00155b6b58318899715bab0527871783682f6dcfb8ed8ae037e93b9fb3e6
SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMj:rKf1PyKa2H3hOHOHz9JQ6zBQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf

File Explorer

e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf

.exe 445KB

e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf

IMPHASH b6852ed4e334147c4929ea4ff7285899
SHA256 e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf
MD5 3f032cb7c4611688a2ed93132db128ea
SHA1 b5635ace9c98d50756b318f9a6c687d5846e2604
SHA512 c6ee2235bc5a64a71642ac5a4fbea72bfa9bcaee57cfc49ce3543f603c86314c7cac00155b6b58318899715bab0527871783682f6dcfb8ed8ae037e93b9fb3e6
SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMj:rKf1PyKa2H3hOHOHz9JQ6zBQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx CloseHandle GetSystemDirectoryW GetTempPathW GetFileAttributesW GetTickCount GetLastError ReadFile SetFilePointer WriteFile FlushFileBuffers CreateFileA DeviceIoControl Sleep SetFileAttributesW DeleteFileW GetCurrentProcessId TerminateProcess GetProcAddress GetTempPathA GetModuleFileNameA SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateFileW OpenEventW CreateEventW CreateThread SetEndOfFile HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetVersionExW MultiByteToWideChar FreeResource LockResource LoadResource SizeofResource GetModuleFileNameW FindResourceW IsProcessorFeaturePresent DeleteCriticalSection GetFileType SetHandleCount GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle GetConsoleMode GetConsoleCP RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW ExitProcess InterlockedDecrement GetCurrentThreadId HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetProcessHeap

user32

LoadCursorW RegisterClassExW LoadStringW wsprintfW LoadIconW CreateWindowExW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

htonl gethostbyaddr WSAStartup socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersInfo