General

  • Target

    9ec9f0b2fb31fc1676c54936e2cb49b0N.exe

  • Size

    84KB

  • Sample

    240805-rt7tbssfng

  • MD5

    9ec9f0b2fb31fc1676c54936e2cb49b0

  • SHA1

    33d519d1dd5834131134838e24d28dd66f2f2612

  • SHA256

    5bdf8c0bd4b6bfef666605a0f007affdaa0c25683b1181c08ea425a75ac0d652

  • SHA512

    7572b9416f68004a4496b152d7c29bbe76873afe4a59436b328893f348aa38840d1cbefdc0eb6ca88265cd681d8dd53224deb66e09e0f923826ba84450b52203

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFr:JznH976dUCnuniDN

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Targets

    • Target

      9ec9f0b2fb31fc1676c54936e2cb49b0N.exe

    • Size

      84KB

    • MD5

      9ec9f0b2fb31fc1676c54936e2cb49b0

    • SHA1

      33d519d1dd5834131134838e24d28dd66f2f2612

    • SHA256

      5bdf8c0bd4b6bfef666605a0f007affdaa0c25683b1181c08ea425a75ac0d652

    • SHA512

      7572b9416f68004a4496b152d7c29bbe76873afe4a59436b328893f348aa38840d1cbefdc0eb6ca88265cd681d8dd53224deb66e09e0f923826ba84450b52203

    • SSDEEP

      1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFr:JznH976dUCnuniDN

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks