urelas | f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af

Sharing

Copy URL Twitter E-mail

General

Target
f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af
Size 169KB
Sample240316-bnt3aagd2v
SHA256 f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af
MD5 2eab63300fc445e1c5c0f1348341c8a1
SHA1 000ddb106da3904d85361c2affe17d8756b4fe76
SHA512 c0585bdaaceb1ce63527121e8eaa2033799fb731300ad995224a9d690371873c221f60cfab3a035dc662c22ccce75ead73429e3a02f915e003530c95fa1ba6b2
SSDEEP 1536:DavuZofG6xd6vsi0exJ1WjDebHXUuZcKRswBIg0fUQwYzbQo0gpd86lMQeGAzrS:DAuZXvwYkYcKNeFVz8o0gpGsMQe/XS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af

File Explorer

f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af

.exe 169KB

f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af

IMPHASH 5f856f5eec5016c8e73b2b8e5a9c087d
SHA256 f1578040a3440a7e38a611e9060b26ce0fb92926fc7bcc095492d1c77726d5af
MD5 2eab63300fc445e1c5c0f1348341c8a1
SHA1 000ddb106da3904d85361c2affe17d8756b4fe76
SHA512 c0585bdaaceb1ce63527121e8eaa2033799fb731300ad995224a9d690371873c221f60cfab3a035dc662c22ccce75ead73429e3a02f915e003530c95fa1ba6b2
SSDEEP 1536:DavuZofG6xd6vsi0exJ1WjDebHXUuZcKRswBIg0fUQwYzbQo0gpd86lMQeGAzrS:DAuZXvwYkYcKNeFVz8o0gpGsMQe/XS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21487

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesW GetSystemDirectoryW DeleteFileW GetTickCount GetModuleFileNameW GetVersionExW ReadFile CreateFileW DeviceIoControl GetTempPathA GetModuleFileNameA HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar HeapReAlloc LCMapStringW HeapSize CreateFileA GetSystemWindowsDirectoryW WriteConsoleW FlushFileBuffers IsProcessorFeaturePresent SetStdHandle GetStringTypeW CreateThread CreateEventW CloseHandle OpenEventW GetTempPathW IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement ExitProcess LoadLibraryW Sleep GetCommandLineW HeapSetInformation GetStartupInfoW GetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetProcAddress GetModuleHandleW GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SetEndOfFile

user32

LoadIconW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow LoadAcceleratorsW LoadStringW LoadCursorW wsprintfW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersAddresses