General

  • Target

    31fd42c852a73767983ebfccc333c200_NeikiAnalytics

  • Size

    483KB

  • Sample

    240510-a4fzxsbh95

  • MD5

    31fd42c852a73767983ebfccc333c200

  • SHA1

    40224f8005956adfff4817833e1c657bdb7d0787

  • SHA256

    192fa0e3ad0807e703ac4e6c768a459d8554c59c03e528beda6509c79b8e1730

  • SHA512

    7e0ad71f7649a953f97f97cc0242498134afa330f8ac062b700e958789ed8caa6675dc58ae2f323f9c1fb905a7bc13c0f22bf778fab22dc94838894863c008e6

  • SSDEEP

    12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJU:yIp+RFuDyZCnUzJsG1WW8lFU

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Targets

    • Target

      31fd42c852a73767983ebfccc333c200_NeikiAnalytics

    • Size

      483KB

    • MD5

      31fd42c852a73767983ebfccc333c200

    • SHA1

      40224f8005956adfff4817833e1c657bdb7d0787

    • SHA256

      192fa0e3ad0807e703ac4e6c768a459d8554c59c03e528beda6509c79b8e1730

    • SHA512

      7e0ad71f7649a953f97f97cc0242498134afa330f8ac062b700e958789ed8caa6675dc58ae2f323f9c1fb905a7bc13c0f22bf778fab22dc94838894863c008e6

    • SSDEEP

      12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJU:yIp+RFuDyZCnUzJsG1WW8lFU

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks