urelas | 92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25

Sharing

Copy URL Twitter E-mail

General

Target
92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25
Size 453KB
Sample240316-17tnasfe29
SHA256 92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25
MD5 7cf19309574d5bf7a7e8fd72cda93f93
SHA1 4c5194df07a8625883204ccaf9b9f1a5e550d1f2
SHA512 6428fa21509b031e36c4336c80e541fbeb07818a17f4435de203b88e239cc4fc1ec1020b97f3c663e7fbab4c9addf57f8f28f6cfe7717a7549b43acfcd476590
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoz:PMpASIcWYx2U6hAJQn3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25

File Explorer

92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25

.exe 453KB

92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25

IMPHASH a74af8b06f2835630017cd7cc4b0782d
SHA256 92b968351ca0f23713d1eed75d682397b7e43cffa3b80d0a3df7da3038754c25
MD5 7cf19309574d5bf7a7e8fd72cda93f93
SHA1 4c5194df07a8625883204ccaf9b9f1a5e550d1f2
SHA512 6428fa21509b031e36c4336c80e541fbeb07818a17f4435de203b88e239cc4fc1ec1020b97f3c663e7fbab4c9addf57f8f28f6cfe7717a7549b43acfcd476590
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoz:PMpASIcWYx2U6hAJQn3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer FlushFileBuffers DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateThread SetFileAttributesW GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetTempPathW CreateEventW CloseHandle OpenEventW GetFileAttributesW Sleep GetTickCount ExitProcess SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP GetModuleFileNameW HeapCreate HeapReAlloc HeapAlloc HeapFree GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

EndPaint LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW EndDialog PostQuitMessage BeginPaint DefWindowProcW DestroyWindow

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

WSAGetLastError recv send closesocket connect htons WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr

iphlpapi

GetAdaptersInfo