urelas | aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3

Sharing

Copy URL Twitter E-mail

General

Target
aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3
Size 267KB
Sample240831-j4mbdatfkh
SHA256 aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3
MD5 f037f45976f40bbe49b55ce9a5c2e0aa
SHA1 c2b2ffc75cfc0e6d7f06c184d40775707b7bd9e2
SHA512 3c060099cf054f0bd641113d91ae65ea5993eeb53604f7f7aab299fa8d830e0e194138b96c9b023b968bdc82d8000092be1bb15b414d62d8f7aad48152f597d4
SSDEEP 6144:KAV1QVyt6drNwjdy42uGpwOjLG0mDw55BJojIDd+hcd5Zp:jV2Vcm5qiudOYDw5iUhecDP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42

File Explorer

aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3

.zip 267KB
342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42

.exe 448KB

aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3

SHA256 aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3
MD5 f037f45976f40bbe49b55ce9a5c2e0aa
SHA1 c2b2ffc75cfc0e6d7f06c184d40775707b7bd9e2
SHA512 3c060099cf054f0bd641113d91ae65ea5993eeb53604f7f7aab299fa8d830e0e194138b96c9b023b968bdc82d8000092be1bb15b414d62d8f7aad48152f597d4
SSDEEP 6144:KAV1QVyt6drNwjdy42uGpwOjLG0mDw55BJojIDd+hcd5Zp:jV2Vcm5qiudOYDw5iUhecDP
MD5 SHA1 SHA512 SSDEEP

Password

infected

342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42

IMPHASH a74af8b06f2835630017cd7cc4b0782d
SHA256 342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42
MD5 bd3fa5a77300929f8aaf0507d42c6a74
SHA1 a2cee10533ce7bfa7b8a1c4fa51e3a77344c7455
SHA512 31908fab6b77ae34c4c795d469b49cc5326c7983c718ad8d04bf4b33f1f6e65c4f7f8bb9e0477cb691f49ccfb7dc4aac1a1050147f167c02f250d4d3493d1adc
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomNh:PMpASIcWYx2U6hAJQnO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer FlushFileBuffers DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateThread SetFileAttributesW GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetTempPathW CreateEventW CloseHandle OpenEventW GetFileAttributesW Sleep GetTickCount ExitProcess SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP GetModuleFileNameW HeapCreate HeapReAlloc HeapAlloc HeapFree GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

EndPaint LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW EndDialog PostQuitMessage BeginPaint DefWindowProcW DestroyWindow

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

WSAGetLastError recv send closesocket connect htons WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr

iphlpapi

GetAdaptersInfo