Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c1dc430310d6e2074a5fbd18f0186750_NeikiAnalytics

  • Size

    289KB

  • Sample

    240509-w6xlcabf36

  • MD5

    c1dc430310d6e2074a5fbd18f0186750

  • SHA1

    eeaf4be820612ddd68fda301e3822e8262e18a3f

  • SHA256

    ef34a75ab283b5e9cd79494737d7adec7a8c3ff6de1b7a5ef822c3e248c7a175

  • SHA512

    97d73ddf011ea29c7b0e4656d040207a494915b06be13070f305a8674136c3990033df2be7060be44ca798fc7a998e3d434078a967ae637f66506aab0584fcd1

  • SSDEEP

    6144:96xwSR5NtUIJEWyXuew+q1l0d2Js6H5/TZkKy:9A3NtUISdPw+Elq2Jsm2t

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Targets

    • Target

      c1dc430310d6e2074a5fbd18f0186750_NeikiAnalytics

    • Size

      289KB

    • MD5

      c1dc430310d6e2074a5fbd18f0186750

    • SHA1

      eeaf4be820612ddd68fda301e3822e8262e18a3f

    • SHA256

      ef34a75ab283b5e9cd79494737d7adec7a8c3ff6de1b7a5ef822c3e248c7a175

    • SHA512

      97d73ddf011ea29c7b0e4656d040207a494915b06be13070f305a8674136c3990033df2be7060be44ca798fc7a998e3d434078a967ae637f66506aab0584fcd1

    • SSDEEP

      6144:96xwSR5NtUIJEWyXuew+q1l0d2Js6H5/TZkKy:9A3NtUISdPw+Elq2Jsm2t

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks