General

  • Target

    7b265e33408651503993728ef02b990d_JaffaCakes118

  • Size

    436KB

  • Sample

    240731-ed34zsvern

  • MD5

    7b265e33408651503993728ef02b990d

  • SHA1

    e04b5c90c5fd84b42d279ad6ad487f3f6246219d

  • SHA256

    4424fa680a988afb5defe2afc22eb4b2d367823de222d0708502c957e4e0d1ed

  • SHA512

    d7f1817f4cde6e0b8e73549e085cbb2ad2d956afa3bf81b78fe0d493fa5760ce00ebbf0d5bf91688fce37d6f72989406e183ce1bf275a96001a45669874ec8c8

  • SSDEEP

    6144:2zU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOtsvFwfMHAXj:4U7M5ijWh0XOW4sEfeOSJHAz

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Targets

    • Target

      7b265e33408651503993728ef02b990d_JaffaCakes118

    • Size

      436KB

    • MD5

      7b265e33408651503993728ef02b990d

    • SHA1

      e04b5c90c5fd84b42d279ad6ad487f3f6246219d

    • SHA256

      4424fa680a988afb5defe2afc22eb4b2d367823de222d0708502c957e4e0d1ed

    • SHA512

      d7f1817f4cde6e0b8e73549e085cbb2ad2d956afa3bf81b78fe0d493fa5760ce00ebbf0d5bf91688fce37d6f72989406e183ce1bf275a96001a45669874ec8c8

    • SSDEEP

      6144:2zU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOtsvFwfMHAXj:4U7M5ijWh0XOW4sEfeOSJHAz

    • Urelas

      Urelas is a trojan targeting card games.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks