urelas | fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3

Sharing

Copy URL Twitter E-mail

General

Target
fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3
Size 274KB
Sample240805-gcfcmsybkk
SHA256 fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3
MD5 f9d00f7699813cc5bb0a8ac8c5d16587
SHA1 e1fe07952c2801edc558d796db210a7d73618219
SHA512 bc812f6be813f7f472fe3145c5476720e169f60901c41c0cc758c0447df0c10e8da5e56dbee884c84edf9fd8463364c2bb614d7ec84cc0072426a8c63b081e82
SSDEEP 3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jj0wA6m:pOzRWu27dlOd5W0Ih
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3

File Explorer

fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3

.exe 274KB

fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3

IMPHASH 20a65708a7dec8717ddde5543493257a
SHA256 fd2b764bb57ea391ba5faf686914d5fc11ef5227ba71f101839df05bcc590cb3
MD5 f9d00f7699813cc5bb0a8ac8c5d16587
SHA1 e1fe07952c2801edc558d796db210a7d73618219
SHA512 bc812f6be813f7f472fe3145c5476720e169f60901c41c0cc758c0447df0c10e8da5e56dbee884c84edf9fd8463364c2bb614d7ec84cc0072426a8c63b081e82
SSDEEP 3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jj0wA6m:pOzRWu27dlOd5W0Ih
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30611

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathW GetSystemDirectoryW DeleteFileW GetModuleFileNameW GetTickCount GetVersionExW ReadFile CreateFileW DeviceIoControl GetTempPathA GetModuleFileNameA HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar SetEndOfFile HeapReAlloc LCMapStringW CreateThread LoadLibraryW OutputDebugStringW LoadLibraryExW WriteConsoleW FlushFileBuffers SetStdHandle CreateEventW ExitProcess CloseHandle Sleep OpenEventW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage RaiseException SetFilePointerEx SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter DeleteCriticalSection GetFileType GetFileAttributesW GetSystemWindowsDirectoryW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetModuleHandleExW AreFileApisANSI GetStdHandle HeapSize

user32

GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW LoadAcceleratorsW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW LoadStringW wsprintfW LoadIconW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersAddresses