General

  • Target

    59f0820e1dba93f32143edd3016243e0N.exe

  • Size

    53KB

  • Sample

    240801-kfcbyawble

  • MD5

    59f0820e1dba93f32143edd3016243e0

  • SHA1

    29ca84156e31cf22dff3784e0ea8fe16beacb5ac

  • SHA256

    d620b15623bb352588dbe7e71ed15be7018750380cf5670c0acfec5612b28d9c

  • SHA512

    5378d3b9a667f59c18d8544269441f5a0f331e1730c6fa6038b8508d58bf74d7a8c33c60822d1621fb932f265070776224c2f1304f8b852df9f7a3acfd28929f

  • SSDEEP

    1536:TlnBzGPEdPJpUI4QP4BDK3XmbPfKJ97ifa:JnBGPUMQwBDamb3a7iy

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Targets

    • Target

      59f0820e1dba93f32143edd3016243e0N.exe

    • Size

      53KB

    • MD5

      59f0820e1dba93f32143edd3016243e0

    • SHA1

      29ca84156e31cf22dff3784e0ea8fe16beacb5ac

    • SHA256

      d620b15623bb352588dbe7e71ed15be7018750380cf5670c0acfec5612b28d9c

    • SHA512

      5378d3b9a667f59c18d8544269441f5a0f331e1730c6fa6038b8508d58bf74d7a8c33c60822d1621fb932f265070776224c2f1304f8b852df9f7a3acfd28929f

    • SSDEEP

      1536:TlnBzGPEdPJpUI4QP4BDK3XmbPfKJ97ifa:JnBGPUMQwBDamb3a7iy

    Score
    10/10
    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks