urelas | c0fe9bd0c8b53673069794cdfe3c3e55

Sharing

Copy URL Twitter E-mail

General

Target
c0fe9bd0c8b53673069794cdfe3c3e55
Size 348KB
Sample240311-tdsetaag99
SHA256 352e47d9fe7b3b74e35e0f277f3403168bc9aaa9ff65349c54340c3320968929
MD5 c0fe9bd0c8b53673069794cdfe3c3e55
SHA1 c2fb7d917fb9a55bcf76d23b2718bf869f435401
SHA512 82e6b1b49e78ffbeb0ab8a117e07916bacc3c1282c9c1435de860905f6a2ae7953159ed4b20eb60d8359eb9c30dae82075576996b8092c37ec43cf9255cd9a6e
SSDEEP 6144:E/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZU:Y0G5obGGraOpUWlpX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0fe9bd0c8b53673069794cdfe3c3e55

File Explorer

c0fe9bd0c8b53673069794cdfe3c3e55

.exe 348KB

c0fe9bd0c8b53673069794cdfe3c3e55

IMPHASH 1a7336ed8b77b7e34502eccb0e5ec8d2
SHA256 352e47d9fe7b3b74e35e0f277f3403168bc9aaa9ff65349c54340c3320968929
MD5 c0fe9bd0c8b53673069794cdfe3c3e55
SHA1 c2fb7d917fb9a55bcf76d23b2718bf869f435401
SHA512 82e6b1b49e78ffbeb0ab8a117e07916bacc3c1282c9c1435de860905f6a2ae7953159ed4b20eb60d8359eb9c30dae82075576996b8092c37ec43cf9255cd9a6e
SSDEEP 6144:E/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZU:Y0G5obGGraOpUWlpX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12825

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateEventW CreateThread GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer OpenEventW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CopyFileW GetTempPathW GetFileAttributesW Sleep GetTickCount ExitProcess FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP HeapCreate HeapDestroy HeapReAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW DestroyWindow DefWindowProcW EndDialog PostQuitMessage EndPaint BeginPaint

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

htonl connect WSAGetLastError recv send WSAStartup closesocket gethostbyaddr socket gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

Name

.text

Size

110KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

JHDFRWG

Size

50KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

c0fe9bd0c8b53673069794cdfe3c3e55

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

generic