urelas | 3efbbd055562a957c564cff3ce82a1fc1fedbe9289afa9226e6ad6457512b7f2 | Triage

Sharing

General

Target

257b8aaab91a0b6da5b933a8bbe1d360_NeikiAnalytics.exe
Size

58KB
Sample

240604-dmyeesbb5s
MD5

257b8aaab91a0b6da5b933a8bbe1d360
SHA1

0d8f8414a17473d4f9ce38be86f22d6d58863f2c
SHA256

3efbbd055562a957c564cff3ce82a1fc1fedbe9289afa9226e6ad6457512b7f2
SHA512

b9a0f11a6daec939182cf9de14f99b2e24396897d0da13034f17eb6544c09c5b2766bc9d237d66fcb743204a9988a70905794a2272d7705fb0c6f75c9ee7cfe7
SSDEEP

1536:l7X2lykmUO2drIYfdQ3W8PTZEd4Ejf/kE/Q6mhnDxMmKyx:VXmykmU9If3h1O4Eb/eOc

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.207

Targets

- Target
  
  257b8aaab91a0b6da5b933a8bbe1d360_NeikiAnalytics.exe
- Size
  
  58KB
- MD5
  
  257b8aaab91a0b6da5b933a8bbe1d360
- SHA1
  
  0d8f8414a17473d4f9ce38be86f22d6d58863f2c
- SHA256
  
  3efbbd055562a957c564cff3ce82a1fc1fedbe9289afa9226e6ad6457512b7f2
- SHA512
  
  b9a0f11a6daec939182cf9de14f99b2e24396897d0da13034f17eb6544c09c5b2766bc9d237d66fcb743204a9988a70905794a2272d7705fb0c6f75c9ee7cfe7
- SSDEEP
  
  1536:l7X2lykmUO2drIYfdQ3W8PTZEd4Ejf/kE/Q6mhnDxMmKyx:VXmykmU9If3h1O4Eb/eOc
Score

10^/10

urelas trojan
- Urelas
  Urelas is a trojan targeting card games.
  trojan urelas
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2