General

  • Target

    9561abeba0db4191ff9ce21971e16a70N.exe

  • Size

    84KB

  • Sample

    240725-hvlstaxfra

  • MD5

    9561abeba0db4191ff9ce21971e16a70

  • SHA1

    1880a0c927ffaa97f994f31adbb2212ba10e8df2

  • SHA256

    56d68517d16e95c2cdfaa28af78688e8b5777a6fae462d5bc222a11e0560c353

  • SHA512

    f481e83a96d233449c0ed0c3cf8368b4330ce6e02f26fa8c96a23bd9af7b9f24974901a0ff9d6bad1111ac3d4aa80164acf7c782f93cb72ffa6aeaf651bc19c6

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURH:JznH976dUCnuniDT

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Targets

    • Target

      9561abeba0db4191ff9ce21971e16a70N.exe

    • Size

      84KB

    • MD5

      9561abeba0db4191ff9ce21971e16a70

    • SHA1

      1880a0c927ffaa97f994f31adbb2212ba10e8df2

    • SHA256

      56d68517d16e95c2cdfaa28af78688e8b5777a6fae462d5bc222a11e0560c353

    • SHA512

      f481e83a96d233449c0ed0c3cf8368b4330ce6e02f26fa8c96a23bd9af7b9f24974901a0ff9d6bad1111ac3d4aa80164acf7c782f93cb72ffa6aeaf651bc19c6

    • SSDEEP

      1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURH:JznH976dUCnuniDT

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks