General

  • Target

    7Y18r(227).exe

  • Size

    481KB

  • Sample

    240724-wdgz7azalr

  • MD5

    c7f8a3e04135f6437f0e3f05f7a09bf0

  • SHA1

    700034ebd5cfe7aad47bafb26a1ce7e0339f2cc3

  • SHA256

    3c91ffa9919a12fa6aecccedb830fd5147486612617ba999fc652aacd110e284

  • SHA512

    f27f1625ac1072962ddedd61bc5f8927639bc62b0df9fc42c56cde3232fcaece8c946bffc733e65d486cba2b9384a120224a21b3ba7e3372f3aaf682cd60e3bb

  • SSDEEP

    12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJz:yIp+RFuDyZCnUzJsG1WW8lFz

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Targets

    • Target

      7Y18r(227).exe

    • Size

      481KB

    • MD5

      c7f8a3e04135f6437f0e3f05f7a09bf0

    • SHA1

      700034ebd5cfe7aad47bafb26a1ce7e0339f2cc3

    • SHA256

      3c91ffa9919a12fa6aecccedb830fd5147486612617ba999fc652aacd110e284

    • SHA512

      f27f1625ac1072962ddedd61bc5f8927639bc62b0df9fc42c56cde3232fcaece8c946bffc733e65d486cba2b9384a120224a21b3ba7e3372f3aaf682cd60e3bb

    • SSDEEP

      12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJz:yIp+RFuDyZCnUzJsG1WW8lFz

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks