urelas | c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e

Sharing

Copy URL Twitter E-mail

General

Target
c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e
Size 147KB
Sample240316-3s2fpshc43
SHA256 c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e
MD5 03658b946ac0a9c0df49f1b5e7c87206
SHA1 c4f83d6791833462add5f90e34a8318c08cbb660
SHA512 82a7a1655d88394d018ff334831df458afa73835e943c9b32340d3c232da11d6acaaa632b73084a21c86d7e8b8d7345568474e605c432ccfeda130f5fe64f875
SSDEEP 3072:L/5FqCxiXEcO3XfGf2tMUW6o5gRwdllDzXv:L/5FqCxUElfQDR5gRC3f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e

File Explorer

c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e

.exe 147KB

c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e

IMPHASH d0a02458b96b0a6cde3068c96d1cdba2
SHA256 c3c50a5e04cf999e097087219f291c86ded5368a5134d2d6613939768ce2b03e
MD5 03658b946ac0a9c0df49f1b5e7c87206
SHA1 c4f83d6791833462add5f90e34a8318c08cbb660
SHA512 82a7a1655d88394d018ff334831df458afa73835e943c9b32340d3c232da11d6acaaa632b73084a21c86d7e8b8d7345568474e605c432ccfeda130f5fe64f875
SSDEEP 3072:L/5FqCxiXEcO3XfGf2tMUW6o5gRwdllDzXv:L/5FqCxUElfQDR5gRC3f
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21039

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathW GetSystemDirectoryW DeleteFileW GetModuleFileNameW GetTickCount GetVersionExW ReadFile CreateFileW DeviceIoControl GetTempPathA GetModuleFileNameA HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar SetEndOfFile HeapReAlloc LCMapStringW CreateThread LoadLibraryW OutputDebugStringW LoadLibraryExW WriteConsoleW FlushFileBuffers SetStdHandle CreateEventW ExitProcess CloseHandle Sleep OpenEventW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage RaiseException SetFilePointerEx SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter DeleteCriticalSection GetFileType GetFileAttributesW GetSystemWindowsDirectoryW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetModuleHandleExW AreFileApisANSI GetStdHandle HeapSize

user32

LoadAcceleratorsW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW LoadStringW wsprintfW LoadIconW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersAddresses