urelas | c00d397e17d5377c57bd006444706cd070596c2734ebaaa82d3b85885dfb8458 | Triage

Sharing

General

Target

c00d397e17d5377c57bd006444706cd070596c2734ebaaa82d3b85885dfb8458
Size

55KB
Sample

240703-cyhyfaxbnr
MD5

0ebae16c39dcdebce31999d67707daef
SHA1

387dc304bb978a4271f272d1c1cf6824b6c7e772
SHA256

c00d397e17d5377c57bd006444706cd070596c2734ebaaa82d3b85885dfb8458
SHA512

57047c76d3f33b5d4a999008064e17d9d7da429bc295cb4071072856ad5eb25fa419cee50d6320d821d89c59a7cdf70fe5c23ceb683d5e0d2746f5e438026928
SSDEEP

1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS8e:MOemdTd1o74qlmbbJ+x+Ik0

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Targets

- Target
  
  c00d397e17d5377c57bd006444706cd070596c2734ebaaa82d3b85885dfb8458
- Size
  
  55KB
- MD5
  
  0ebae16c39dcdebce31999d67707daef
- SHA1
  
  387dc304bb978a4271f272d1c1cf6824b6c7e772
- SHA256
  
  c00d397e17d5377c57bd006444706cd070596c2734ebaaa82d3b85885dfb8458
- SHA512
  
  57047c76d3f33b5d4a999008064e17d9d7da429bc295cb4071072856ad5eb25fa419cee50d6320d821d89c59a7cdf70fe5c23ceb683d5e0d2746f5e438026928
- SSDEEP
  
  1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS8e:MOemdTd1o74qlmbbJ+x+Ik0
Score

10^/10

urelas trojan
- Urelas
  Urelas is a trojan targeting card games.
  trojan urelas
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2