General

  • Target

    f65d8bf522dfa45bdcde26623f249ba0N.exe

  • Size

    84KB

  • Sample

    240804-wmb6as1fnq

  • MD5

    f65d8bf522dfa45bdcde26623f249ba0

  • SHA1

    4794401bd90d874dbe1c31e05d59a7e176dad1bd

  • SHA256

    c56f8d3b2945eeeafb159b5d98e933c2a731a507df022c21f7f214770ce36416

  • SHA512

    ea6d950da436b030616c314ddf8f4201c38165f6baded6b7c10c7aaaf2bc9b908c22746434202185e3b13cc9839d794f5627b68b8f1821ec110c70d77151669d

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFb:JznH976dUCnuniD1

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Targets

    • Target

      f65d8bf522dfa45bdcde26623f249ba0N.exe

    • Size

      84KB

    • MD5

      f65d8bf522dfa45bdcde26623f249ba0

    • SHA1

      4794401bd90d874dbe1c31e05d59a7e176dad1bd

    • SHA256

      c56f8d3b2945eeeafb159b5d98e933c2a731a507df022c21f7f214770ce36416

    • SHA512

      ea6d950da436b030616c314ddf8f4201c38165f6baded6b7c10c7aaaf2bc9b908c22746434202185e3b13cc9839d794f5627b68b8f1821ec110c70d77151669d

    • SSDEEP

      1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFb:JznH976dUCnuniD1

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks