General

  • Target

    e2e072cf0c977435a7c2588d97e02860N.exe

  • Size

    415KB

  • Sample

    240804-f1yy8asapa

  • MD5

    e2e072cf0c977435a7c2588d97e02860

  • SHA1

    991f599a4d440c36f7918603d2b47b3dd1a2b673

  • SHA256

    68d609fa9ecbdc4aee32234c9acee6de36444fbe637f1f3aaa7d58ca5b13c1f6

  • SHA512

    70e8d154004afa7757e8e2416e29c306a102b26b9f466ad5c28495451684e467be416b72eadfbb06b831b87773712fccf63c96fa77c6549f1660f8f08aea7c89

  • SSDEEP

    6144:kzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOYKSS:eU7M5ijWh0XOW4sEfeO1

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Targets

    • Target

      e2e072cf0c977435a7c2588d97e02860N.exe

    • Size

      415KB

    • MD5

      e2e072cf0c977435a7c2588d97e02860

    • SHA1

      991f599a4d440c36f7918603d2b47b3dd1a2b673

    • SHA256

      68d609fa9ecbdc4aee32234c9acee6de36444fbe637f1f3aaa7d58ca5b13c1f6

    • SHA512

      70e8d154004afa7757e8e2416e29c306a102b26b9f466ad5c28495451684e467be416b72eadfbb06b831b87773712fccf63c96fa77c6549f1660f8f08aea7c89

    • SSDEEP

      6144:kzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOYKSS:eU7M5ijWh0XOW4sEfeO1

    • Urelas

      Urelas is a trojan targeting card games.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks