urelas | 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3

Sharing

Copy URL Twitter E-mail

General

Target
4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3
Size 368KB
Sample240310-zkzqcsbf64
SHA256 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3
MD5 23004245ae5f9a67e5a05834ac4a86d8
SHA1 9426e404d952d8d9992c28b5bd7cb48171d8c5aa
SHA512 eb58bb1b1bbfa638b5593566484fdcfa6272dc26336ee4a690af58353348320629c73007d34e41cc69e2705b1760c6147fba4d8359f2c207754fc44c13bc3a07
SSDEEP 6144:CcKp6l030ly3Li2pmzGqGsl5lvyRn3uXdu0ua8RiVpJm:CrAM0ly3O2A9GApq3uJ0i4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3

File Explorer

4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3

.exe 368KB

4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3

IMPHASH b1068a487ac672489a2cabf69e560fc3
SHA256 4397c70af0bfa1f6d9067f6fc4ce0d61ad6f96d817426726c1403e11b4c8afa3
MD5 23004245ae5f9a67e5a05834ac4a86d8
SHA1 9426e404d952d8d9992c28b5bd7cb48171d8c5aa
SHA512 eb58bb1b1bbfa638b5593566484fdcfa6272dc26336ee4a690af58353348320629c73007d34e41cc69e2705b1760c6147fba4d8359f2c207754fc44c13bc3a07
SSDEEP 6144:CcKp6l030ly3Li2pmzGqGsl5lvyRn3uXdu0ua8RiVpJm:CrAM0ly3O2A9GApq3uJ0i4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileW GetSystemDirectoryW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer FlushFileBuffers DeviceIoControl SetFileAttributesW SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte GetTempPathW GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetModuleFileNameW CreateThread CreateEventW CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess LoadLibraryA InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP GetStartupInfoA Sleep GetFileType SetHandleCount HeapAlloc HeapFree GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetStdHandle RtlUnwind

user32

PostQuitMessage LoadStringW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow wsprintfW EndDialog EndPaint BeginPaint DefWindowProcW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

WSAGetLastError recv send closesocket connect htons WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr

iphlpapi

GetAdaptersInfo