urelas | 01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5

Sharing

Copy URL Twitter E-mail

General

Target
01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5
Size 420KB
Sample240313-vnw2escd43
SHA256 01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5
MD5 3477f317276bf2d4ed1a92ece69b7c18
SHA1 87baec845ee28b294a49dc3368de06c1a63f524f
SHA512 cb5111df85eec1cd0fee5c77ebc5a09cecff07bcef19c22ae0d5abf918b8a835e68fa9faaee5a0e8c93bc38c027ac660d84b37e78a76490630e9ea0474c866cb
SSDEEP 6144:UzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODGY:uU7M5ijWh0XOW4sEfeOn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5

File Explorer

01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5

.exe 420KB

01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 01ae502f888424cdc5d5066e06043e187fbc928e7edb610cd6b1b034908f72c5
MD5 3477f317276bf2d4ed1a92ece69b7c18
SHA1 87baec845ee28b294a49dc3368de06c1a63f524f
SHA512 cb5111df85eec1cd0fee5c77ebc5a09cecff07bcef19c22ae0d5abf918b8a835e68fa9faaee5a0e8c93bc38c027ac660d84b37e78a76490630e9ea0474c866cb
SSDEEP 6144:UzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODGY:uU7M5ijWh0XOW4sEfeOn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification