Overview

overview

10

Static

static

3

f2ba1c1c4f...30.exe

windows7-x64

10

f2ba1c1c4f...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2ba1c1c4fc4f63461c8ed70d2c65edeef172e9d282dc561bab1d88640273530

  • Size

    6.5MB

  • Sample

    240523-fehp4sec62

  • MD5

    92e0624826b4f17f1fcf2b53e454c216

  • SHA1

    f079f61759d17db1440b09837cdc99817c42a65b

  • SHA256

    f2ba1c1c4fc4f63461c8ed70d2c65edeef172e9d282dc561bab1d88640273530

  • SHA512

    5b4cfcebe3b2faee309baa3e4d90f4157e055c9044868f95fcec9080a72f76384a31967e0c3ca48435bbcf66ebaa7be5fc718e3c4d86f3c6ec103f4234ea61e3

  • SSDEEP

    98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSD:i0LrA2kHKQHNk3og9unipQyOaOD

Score
10/10
urelastrojanupx

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Targets

    • Target

      f2ba1c1c4fc4f63461c8ed70d2c65edeef172e9d282dc561bab1d88640273530

    • Size

      6.5MB

    • MD5

      92e0624826b4f17f1fcf2b53e454c216

    • SHA1

      f079f61759d17db1440b09837cdc99817c42a65b

    • SHA256

      f2ba1c1c4fc4f63461c8ed70d2c65edeef172e9d282dc561bab1d88640273530

    • SHA512

      5b4cfcebe3b2faee309baa3e4d90f4157e055c9044868f95fcec9080a72f76384a31967e0c3ca48435bbcf66ebaa7be5fc718e3c4d86f3c6ec103f4234ea61e3

    • SSDEEP

      98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSD:i0LrA2kHKQHNk3og9unipQyOaOD

    Score
    10/10
    urelastrojanupx

    • Urelas

      Urelas is a trojan targeting card games.

      trojanurelas

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks