urelas | 1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba

Sharing

Copy URL Twitter E-mail

General

Target
1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba
Size 414KB
Sample240403-xsbmdshh7s
SHA256 1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba
MD5 31002b48a3251b2fff42d3539f60aacb
SHA1 525cdc59a7a0ad73534294aae6a96b50832a1c14
SHA512 c8889806b043f00928d60faa400bfc26150a2167a07b46ffdabd93fc28cdb991c665542fd255c811aec25c6bd434e38b5392b82baec176d0436d5122f9feb18b
SSDEEP 6144:bzwArTEDSCs5wL0DKlpn/URBudL7qRBpkvfsModogZ/SvnDTH958:bMmQDSCs5wo0e8L7qRbQUugennHY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba

File Explorer

1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba

.exe 414KB

1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba

IMPHASH d321d21d32e96638b07768beb0741790
SHA256 1a94494ebd68384b51a717208c96b7b7c6b7bf3b3489795df25c535e2d9815ba
MD5 31002b48a3251b2fff42d3539f60aacb
SHA1 525cdc59a7a0ad73534294aae6a96b50832a1c14
SHA512 c8889806b043f00928d60faa400bfc26150a2167a07b46ffdabd93fc28cdb991c665542fd255c811aec25c6bd434e38b5392b82baec176d0436d5122f9feb18b
SSDEEP 6144:bzwArTEDSCs5wL0DKlpn/URBudL7qRBpkvfsModogZ/SvnDTH958:bMmQDSCs5wo0e8L7qRbQUugennHY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42687

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateEventW Sleep GetTickCount GetSystemDirectoryW CreateFileW DeviceIoControl ReadFile GetTempPathA GetModuleFileNameA CreateFileA WriteFile CreateThread MultiByteToWideChar ExitProcess GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileSizeEx SetFileAttributesW GetLastError SetFilePointer SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CloseHandle GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA OpenEventW DeleteFileW GetFileAttributesW GetTempPathW GetModuleFileNameW LoadLibraryA WriteConsoleW GetConsoleOutputCP WriteConsoleA HeapSize FlushFileBuffers SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetCommandLineW GetModuleHandleA GetVersionExW HeapAlloc HeapFree GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind RaiseException GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW

user32

LoadCursorW RegisterClassExW CreateWindowExW DefWindowProcW LoadStringW LoadIconW wsprintfW PostQuitMessage EndPaint BeginPaint

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersInfo