urelas | 5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N

Sharing

Copy URL Twitter E-mail

General

Target
5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N
Size 597KB
Sample241010-ngc7eazfmp
SHA256 5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675
MD5 f9c91e2058f13e0e9585a2f79eba4bf0
SHA1 913233de058e01f3d5a4240659d593c77d32e28d
SHA512 398326b16d86935d970d1cfccf38415dcf0cf2149c3f671fcca3fdd7769fb28dabbf5e0aa74c3ca550f3922423028c7826bc4c5152a678ee0af9f0cbe1bc1f64
SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpB2:MU7MLb4BQkntwNjqdR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N

File Explorer

5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N

.exe 597KB

5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675
MD5 f9c91e2058f13e0e9585a2f79eba4bf0
SHA1 913233de058e01f3d5a4240659d593c77d32e28d
SHA512 398326b16d86935d970d1cfccf38415dcf0cf2149c3f671fcca3fdd7769fb28dabbf5e0aa74c3ca550f3922423028c7826bc4c5152a678ee0af9f0cbe1bc1f64
SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpB2:MU7MLb4BQkntwNjqdR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification