urelas | Trojan[.]Autorun[.]ATA_virussign[.]com_77e0664bd5a6949651d07388fe420d54[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Trojan.Autorun.ATA_virussign.com_77e0664bd5a6949651d07388fe420d54.exe
Size 154KB
Sample240907-ptjqdsvgpp
SHA256 4c921ab5287f68b981876b17ec72f21bc37fe5ddc808136ca3bc37f5cd4c9a2e
MD5 77e0664bd5a6949651d07388fe420d54
SHA1 3b386201732da4b6007a60be9480009ff553568a
SHA512 43675ab7b7155e67204c1f3056f0b83bf3727fbdaafcc54532ca6e575001f6d6cfb4b64cc1648f2f6ea726a98691e17c2cf043b026eabfcd9619ba9a6c7cc63d
SSDEEP 3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2OeR:Nt2vsx+AV4LfLO4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Trojan.Autorun.ATA_virussign.com_77e0664bd5a6949651d07388fe420d54.exe

File Explorer

Trojan.Autorun.ATA_virussign.com_77e0664bd5a6949651d07388fe420d54.exe

.exe 154KB

Trojan.Autorun.ATA_virussign.com_77e0664bd5a6949651d07388fe420d54.exe

IMPHASH d0a02458b96b0a6cde3068c96d1cdba2
SHA256 4c921ab5287f68b981876b17ec72f21bc37fe5ddc808136ca3bc37f5cd4c9a2e
MD5 77e0664bd5a6949651d07388fe420d54
SHA1 3b386201732da4b6007a60be9480009ff553568a
SHA512 43675ab7b7155e67204c1f3056f0b83bf3727fbdaafcc54532ca6e575001f6d6cfb4b64cc1648f2f6ea726a98691e17c2cf043b026eabfcd9619ba9a6c7cc63d
SSDEEP 3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2OeR:Nt2vsx+AV4LfLO4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21067

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20140408)\GbpUpdate_2012\Release\GbpUpdate.pdb

kernel32

GetTempPathW GetSystemDirectoryW DeleteFileW GetModuleFileNameW GetTickCount GetVersionExW ReadFile CreateFileW DeviceIoControl GetTempPathA GetModuleFileNameA HeapAlloc GetProcessHeap HeapFree MultiByteToWideChar SetEndOfFile HeapReAlloc LCMapStringW CreateThread LoadLibraryW OutputDebugStringW LoadLibraryExW WriteConsoleW FlushFileBuffers SetStdHandle CreateEventW ExitProcess CloseHandle Sleep OpenEventW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage RaiseException SetFilePointerEx SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter DeleteCriticalSection GetFileType GetFileAttributesW GetSystemWindowsDirectoryW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineW GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP InterlockedIncrement InterlockedDecrement GetCurrentThreadId GetModuleHandleExW AreFileApisANSI GetStdHandle HeapSize

user32

LoadAcceleratorsW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW LoadStringW wsprintfW LoadIconW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

WSAStartup htonl gethostbyaddr socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersAddresses