General

  • Target

    c1a10d79b96a9be050614303a00d5769f53389d9ce07c980eb3b0b9b2ea70b6f

  • Size

    84KB

  • Sample

    240804-dbeg6stfnq

  • MD5

    7d9c1d227489cdf95f640ce982407a5b

  • SHA1

    5f9e4aabd212e22b12e8d7acc9557cf7ad60cab4

  • SHA256

    c1a10d79b96a9be050614303a00d5769f53389d9ce07c980eb3b0b9b2ea70b6f

  • SHA512

    a54aa25dd7fd89e022206c0a8496e165849f378de4dd252b737e60fd0fd5a1d20714664906ad056d5b27c953a752ab5368b4e5b42603bc6ded59db73c974e05c

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURF6:JznH976dUCnuniD4

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Targets

    • Target

      c1a10d79b96a9be050614303a00d5769f53389d9ce07c980eb3b0b9b2ea70b6f

    • Size

      84KB

    • MD5

      7d9c1d227489cdf95f640ce982407a5b

    • SHA1

      5f9e4aabd212e22b12e8d7acc9557cf7ad60cab4

    • SHA256

      c1a10d79b96a9be050614303a00d5769f53389d9ce07c980eb3b0b9b2ea70b6f

    • SHA512

      a54aa25dd7fd89e022206c0a8496e165849f378de4dd252b737e60fd0fd5a1d20714664906ad056d5b27c953a752ab5368b4e5b42603bc6ded59db73c974e05c

    • SSDEEP

      1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURF6:JznH976dUCnuniD4

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks