urelas | 2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f

Sharing

Copy URL Twitter E-mail

General

Target
2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f
Size 442KB
Sample240323-xnsecade8w
SHA256 2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f
MD5 e6f5513da83033381983461d1d2260dd
SHA1 a8e3ed2cd827ccd385e5e6daaa1b9021c92bcd29
SHA512 f8ada9f116e68aeba0ff7f8c64572f7fa1427f18ba3d4a506e2cb558120afebf2c3a25c4f4250fad063826d101b1c0943682d277a5fd3981d92e6fb55b6ead76
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdKbe:vMpASIcWYx2U6hAJQnXK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f

File Explorer

2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f

.exe 442KB

2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f

IMPHASH a74af8b06f2835630017cd7cc4b0782d
SHA256 2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f
MD5 e6f5513da83033381983461d1d2260dd
SHA1 a8e3ed2cd827ccd385e5e6daaa1b9021c92bcd29
SHA512 f8ada9f116e68aeba0ff7f8c64572f7fa1427f18ba3d4a506e2cb558120afebf2c3a25c4f4250fad063826d101b1c0943682d277a5fd3981d92e6fb55b6ead76
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdKbe:vMpASIcWYx2U6hAJQnXK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer FlushFileBuffers DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateThread SetFileAttributesW GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetTempPathW CreateEventW CloseHandle OpenEventW GetFileAttributesW Sleep GetTickCount ExitProcess SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP GetModuleFileNameW HeapCreate HeapReAlloc HeapAlloc HeapFree GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

EndPaint LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW EndDialog PostQuitMessage BeginPaint DefWindowProcW DestroyWindow

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

WSAGetLastError recv send closesocket connect htons WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr

iphlpapi

GetAdaptersInfo