General

  • Target

    161db86eb5f9237449a1027c1f63f310N.exe

  • Size

    84KB

  • Sample

    240730-1k85gazhmq

  • MD5

    161db86eb5f9237449a1027c1f63f310

  • SHA1

    db84b6c68774555ec724c737798e289818b25eaf

  • SHA256

    9b3643ecbf7402006d8cf776811ae5190d1a70a8bd3ac491c7c20a8d97691efb

  • SHA512

    cd369f9b767ce4513e0bb42e365ea7f7c34de683b61dcbda0c51ab0dd76964ecade34d25f1639bf65bbb12bd49ff032601f0cefd6be0318bd34712d739a7391e

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURF+:JznH976dUCnuniDI

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Targets

    • Target

      161db86eb5f9237449a1027c1f63f310N.exe

    • Size

      84KB

    • MD5

      161db86eb5f9237449a1027c1f63f310

    • SHA1

      db84b6c68774555ec724c737798e289818b25eaf

    • SHA256

      9b3643ecbf7402006d8cf776811ae5190d1a70a8bd3ac491c7c20a8d97691efb

    • SHA512

      cd369f9b767ce4513e0bb42e365ea7f7c34de683b61dcbda0c51ab0dd76964ecade34d25f1639bf65bbb12bd49ff032601f0cefd6be0318bd34712d739a7391e

    • SSDEEP

      1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURF+:JznH976dUCnuniDI

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks