urelas | 61e367150d3762422d388b12bfd73d3f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
61e367150d3762422d388b12bfd73d3f.zip
Size 267KB
Sample240901-wnazmaxfkr
SHA256 6d4b25ec326231d0f838e207ee6ec6e2f4f551292576209ccd0d8e42888bfe28
MD5 0549be7965e951a14f8cd456d71552eb
SHA1 55b38fae21b185554f5e115b5c0ce78be55d39ad
SHA512 aaf5a9fdf9031b1d6e50a488a4de9833436a92c123ee6ca670dd06639122bd3e8b1e3e02efae83bb2f7674d735302cb7658bdc4e938658dc98c2e3fb77cf135e
SSDEEP 6144:7IgNm13fXfFX8iUFFz7a2sALr4H+6W1JPV6zddSM00WDA:7IW0llU+lWK+6Wzt6hdq0WDA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5

File Explorer

61e367150d3762422d388b12bfd73d3f.zip

.zip 267KB
9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5

.exe 448KB

61e367150d3762422d388b12bfd73d3f.zip

SHA256 6d4b25ec326231d0f838e207ee6ec6e2f4f551292576209ccd0d8e42888bfe28
MD5 0549be7965e951a14f8cd456d71552eb
SHA1 55b38fae21b185554f5e115b5c0ce78be55d39ad
SHA512 aaf5a9fdf9031b1d6e50a488a4de9833436a92c123ee6ca670dd06639122bd3e8b1e3e02efae83bb2f7674d735302cb7658bdc4e938658dc98c2e3fb77cf135e
SSDEEP 6144:7IgNm13fXfFX8iUFFz7a2sALr4H+6W1JPV6zddSM00WDA:7IW0llU+lWK+6Wzt6hdq0WDA
MD5 SHA1 SHA512 SSDEEP

Password

infected

9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5

IMPHASH a74af8b06f2835630017cd7cc4b0782d
SHA256 9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5
MD5 61e367150d3762422d388b12bfd73d3f
SHA1 2cd87ffca2517d6a609ff59682cc96e23584e738
SHA512 3536f3b964fa551686f2ca083289193f6e4a7747697910257955a1d29307a24147b8d50d3a86ed7d2c97503369cd95565c12f103c2d073a3c9810e3ea59139a9
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoji:PMpASIcWYx2U6hAJQnS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

51195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer FlushFileBuffers DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateThread SetFileAttributesW GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetTempPathW CreateEventW CloseHandle OpenEventW GetFileAttributesW Sleep GetTickCount ExitProcess SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP GetModuleFileNameW HeapCreate HeapReAlloc HeapAlloc HeapFree GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

EndPaint LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW EndDialog PostQuitMessage BeginPaint DefWindowProcW DestroyWindow

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

WSAGetLastError recv send closesocket connect htons WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr

iphlpapi

GetAdaptersInfo