General

  • Target

    4e88ce69866c6979eff256b77afcd60d_JaffaCakes118

  • Size

    76KB

  • Sample

    240716-qtr77sxgmf

  • MD5

    4e88ce69866c6979eff256b77afcd60d

  • SHA1

    3d337de4691e71ea0bddaf97723ee085747b7b05

  • SHA256

    e81d2348fdc039fcc2283dd2d2e7a4c1a2cf910d4038f202edefd305f3e84170

  • SHA512

    7edbdfed497c2d0b69fc98d587c1cb5e04bc4359ff4a288659f289c1e46fa279149dc3cc5f304efec316c5f2bd9e17539eaf8cb46845905d43fb79ce7c537844

  • SSDEEP

    1536:mLPFBK011PXLkv8pW+8xGpqv+7CS6pKtPuKIu:49BBhgoJq27j68tPuxu

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Targets

    • Target

      4e88ce69866c6979eff256b77afcd60d_JaffaCakes118

    • Size

      76KB

    • MD5

      4e88ce69866c6979eff256b77afcd60d

    • SHA1

      3d337de4691e71ea0bddaf97723ee085747b7b05

    • SHA256

      e81d2348fdc039fcc2283dd2d2e7a4c1a2cf910d4038f202edefd305f3e84170

    • SHA512

      7edbdfed497c2d0b69fc98d587c1cb5e04bc4359ff4a288659f289c1e46fa279149dc3cc5f304efec316c5f2bd9e17539eaf8cb46845905d43fb79ce7c537844

    • SSDEEP

      1536:mLPFBK011PXLkv8pW+8xGpqv+7CS6pKtPuKIu:49BBhgoJq27j68tPuxu

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks