urelas | 7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504 | Triage

Sharing

General

Target

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe
Size

6.7MB
Sample

240523-b3pq4sha3s
MD5

2017c8bca8ff7fd3d3fe986e50b93139
SHA1

03c80dbc6ebf3dcb888c9c56055d0779b0719017
SHA256

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504
SHA512

52c648bb4e40b3d6f4c76382ecbf4ae2692f34da00f1e62d2e3404ba40bc7aad5a188f67b34f4de1a41341fed059c5dff8fbd870532f0bd955ecf4ef2dc985bb
SSDEEP

196608:b9GWRCGhftfdjM49RncR54SEMgPAU4EXWlz:5vLDfdjM4TyhrgPFf6

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Targets

- Target
  
  7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe
- Size
  
  6.7MB
- MD5
  
  2017c8bca8ff7fd3d3fe986e50b93139
- SHA1
  
  03c80dbc6ebf3dcb888c9c56055d0779b0719017
- SHA256
  
  7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504
- SHA512
  
  52c648bb4e40b3d6f4c76382ecbf4ae2692f34da00f1e62d2e3404ba40bc7aad5a188f67b34f4de1a41341fed059c5dff8fbd870532f0bd955ecf4ef2dc985bb
- SSDEEP
  
  196608:b9GWRCGhftfdjM49RncR54SEMgPAU4EXWlz:5vLDfdjM4TyhrgPFf6
Score

10^/10

urelas trojan
- Urelas
  Urelas is a trojan targeting card games.
  trojan urelas
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2