General

  • Target

    LisectAVT_2403002B_415.exe

  • Size

    467KB

  • Sample

    240725-br2arszarp

  • MD5

    07a64c8b246d9f3c87752aa3530495a5

  • SHA1

    2d6fa4c750cc4a3dcf6cb4a8723fccdfba3f81a1

  • SHA256

    d01bb376b70bd2c3ca8470071fe67c120b54fd92d995aa7f0baf3a07d987aa83

  • SHA512

    25fd77cc0fe0c2204c01fb3009d261270cb668db9777d5675ac297029f98bc8b35d10fd2ed8e834842e16f88f14dca118ebf213bac6dca68c7fc9ae6de79051b

  • SSDEEP

    12288:olJ+TFukCI+P9CcrmwEuBwUqA5qFbAGTALHaspC:00U9CcrmwEPA5qFxT7CC

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Targets

    • Target

      LisectAVT_2403002B_415.exe

    • Size

      467KB

    • MD5

      07a64c8b246d9f3c87752aa3530495a5

    • SHA1

      2d6fa4c750cc4a3dcf6cb4a8723fccdfba3f81a1

    • SHA256

      d01bb376b70bd2c3ca8470071fe67c120b54fd92d995aa7f0baf3a07d987aa83

    • SHA512

      25fd77cc0fe0c2204c01fb3009d261270cb668db9777d5675ac297029f98bc8b35d10fd2ed8e834842e16f88f14dca118ebf213bac6dca68c7fc9ae6de79051b

    • SSDEEP

      12288:olJ+TFukCI+P9CcrmwEuBwUqA5qFbAGTALHaspC:00U9CcrmwEPA5qFxT7CC

    • Urelas

      Urelas is a trojan targeting card games.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks