urelas | bf0f2bf2d83936b96fceba97428f22ec50649e4a9e0772241907aaa4e7a2f7a3 | Triage

Sharing

General

Target

bf0f2bf2d83936b96fceba97428f22ec50649e4a9e0772241907aaa4e7a2f7a3
Size

321KB
Sample

240420-cnrgtseg3v
MD5

a333b1691fed911ad1d83c15e0f30497
SHA1

a8e0e7b068815e96dcea8805039f0ffc5065e62a
SHA256

bf0f2bf2d83936b96fceba97428f22ec50649e4a9e0772241907aaa4e7a2f7a3
SHA512

3fd1be1a7b5d998c2f594d681bc4c59c3693c4138fc2ae4de0be2ca03a98c3498e92e2f171df6288c4c2c103d6f439fb9a24584b991ce2bba9a48b6f3355ea33
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYI:vHW138/iXWlK885rKlGSekcj66ci1

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Targets

- Target
  
  bf0f2bf2d83936b96fceba97428f22ec50649e4a9e0772241907aaa4e7a2f7a3
- Size
  
  321KB
- MD5
  
  a333b1691fed911ad1d83c15e0f30497
- SHA1
  
  a8e0e7b068815e96dcea8805039f0ffc5065e62a
- SHA256
  
  bf0f2bf2d83936b96fceba97428f22ec50649e4a9e0772241907aaa4e7a2f7a3
- SHA512
  
  3fd1be1a7b5d998c2f594d681bc4c59c3693c4138fc2ae4de0be2ca03a98c3498e92e2f171df6288c4c2c103d6f439fb9a24584b991ce2bba9a48b6f3355ea33
- SSDEEP
  
  6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYI:vHW138/iXWlK885rKlGSekcj66ci1
Score

10^/10

urelas trojan
- Urelas
  Urelas is a trojan targeting card games.
  trojan urelas
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2