General

  • Target

    6ef5c7686f846713cf3bf4f5341b7290N.exe

  • Size

    84KB

  • Sample

    240802-hxcypasdkn

  • MD5

    6ef5c7686f846713cf3bf4f5341b7290

  • SHA1

    d7b6bb52bf09d815b982d338cec6af24570cd6de

  • SHA256

    95072f918a1dec0c6ba1773aedaacd96edbdfbf8424521fc293a411c4eafda13

  • SHA512

    b2148606ed4e0d54286dcae945597674e3cde8c6c1b6cc8668d76576c0bd6417960d46376cb73ffa3c38c32d3e9a1ddea3a62ac38a0c3712aef092a60b0bb877

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURB:JznH976dUCnuniDF

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Targets

    • Target

      6ef5c7686f846713cf3bf4f5341b7290N.exe

    • Size

      84KB

    • MD5

      6ef5c7686f846713cf3bf4f5341b7290

    • SHA1

      d7b6bb52bf09d815b982d338cec6af24570cd6de

    • SHA256

      95072f918a1dec0c6ba1773aedaacd96edbdfbf8424521fc293a411c4eafda13

    • SHA512

      b2148606ed4e0d54286dcae945597674e3cde8c6c1b6cc8668d76576c0bd6417960d46376cb73ffa3c38c32d3e9a1ddea3a62ac38a0c3712aef092a60b0bb877

    • SSDEEP

      1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURB:JznH976dUCnuniDF

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks