General

  • Target

    808c54e52e59237255aff6d34511a760N.exe

  • Size

    558KB

  • Sample

    240806-j7vrxsyanh

  • MD5

    808c54e52e59237255aff6d34511a760

  • SHA1

    b3676f18e81917f753e202e483c0b9fb8533d2ec

  • SHA256

    bd6338278e91a2f1c3ee4857c69899640d897a120ae9764759fc9ad2c8b9b78d

  • SHA512

    da396174fb2ddeb2d6b04120cb5f34d09acb75a056a048a387f6e718ff98edf9f060567b219123aef4518a5baedf9d3e6fdc8a7afe8ffbeefb9d6f934e3749e0

  • SSDEEP

    12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEy9:znPfQp9L3olqF9

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Targets

    • Target

      808c54e52e59237255aff6d34511a760N.exe

    • Size

      558KB

    • MD5

      808c54e52e59237255aff6d34511a760

    • SHA1

      b3676f18e81917f753e202e483c0b9fb8533d2ec

    • SHA256

      bd6338278e91a2f1c3ee4857c69899640d897a120ae9764759fc9ad2c8b9b78d

    • SHA512

      da396174fb2ddeb2d6b04120cb5f34d09acb75a056a048a387f6e718ff98edf9f060567b219123aef4518a5baedf9d3e6fdc8a7afe8ffbeefb9d6f934e3749e0

    • SSDEEP

      12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEy9:znPfQp9L3olqF9

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks