urelas | b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2

Sharing

Copy URL Twitter E-mail

General

Target
b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2
Size 58KB
Sample240831-drmtgssfme
SHA256 b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2
MD5 e7b0ac82d077013340afb23e55834536
SHA1 6f7822791198ca69315773f6545f7175a7231066
SHA512 c5b156146e18ecdaddb8a6a6fc732152334bf8f3c209791115793c0b50f1b4e33cd0b322fa0c0e1fe38d1b697bcda1dbdcde8b1c44327edaf1077bab5ce55a46
SSDEEP 768:UnvSlcbZHGIbTNE6t3hKjqdLGCxI/tNcedu2UNqrNJMe/1QpYFgeh4DjhzF4uEG:EHl1xgqpGkoU85JVRh4P43G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39

File Explorer

b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2

.zip 58KB
8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39

.exe 139KB

b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2

SHA256 b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2
MD5 e7b0ac82d077013340afb23e55834536
SHA1 6f7822791198ca69315773f6545f7175a7231066
SHA512 c5b156146e18ecdaddb8a6a6fc732152334bf8f3c209791115793c0b50f1b4e33cd0b322fa0c0e1fe38d1b697bcda1dbdcde8b1c44327edaf1077bab5ce55a46
SSDEEP 768:UnvSlcbZHGIbTNE6t3hKjqdLGCxI/tNcedu2UNqrNJMe/1QpYFgeh4DjhzF4uEG:EHl1xgqpGkoU85JVRh4P43G
MD5 SHA1 SHA512 SSDEEP

Password

infected

8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39

IMPHASH d0a02458b96b0a6cde3068c96d1cdba2
SHA256 8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39
MD5 7a5874812f14d24f281db552be3c44dd
SHA1 73a84ac62f85a8e32a561d855a151cde8ed75041
SHA512 72a11177679671b3bc8beb341644a66d4b45ebbdc77965f749bf6ceda8ad396fa9015dcedccfe4f19d9e7e687d3d96e1c067357cfff82cbd8270281e5004f6a0
SSDEEP 1536:sJoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd0sWz64TNdFOG:DtCc+/h0fmSid01z64TNdFd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathW GetSystemDirectoryW DeleteFileW GetModuleFileNameW GetTickCount GetVersionExW ReadFile CreateFileW DeviceIoControl GetTempPathA GetModuleFileNameA HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar SetEndOfFile HeapReAlloc LCMapStringW CreateThread LoadLibraryW OutputDebugStringW LoadLibraryExW WriteConsoleW FlushFileBuffers SetStdHandle CreateEventW ExitProcess CloseHandle Sleep OpenEventW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage RaiseException SetFilePointerEx SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter DeleteCriticalSection GetFileType GetFileAttributesW GetSystemWindowsDirectoryW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetModuleHandleExW AreFileApisANSI GetStdHandle HeapSize

user32

LoadAcceleratorsW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW LoadStringW wsprintfW LoadIconW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersAddresses