General

  • Target

    42b61e69f8a9cc3b58e67dbd71b86fdec03c24bfb4a4f3af4b02d370802e18f4N

  • Size

    79KB

  • Sample

    241017-ttdllatgmg

  • MD5

    92d6e1e2b8bc980b2094e6786c0292a0

  • SHA1

    ceeafcf82e0ffdc9f31f99511df177efc7052e83

  • SHA256

    42b61e69f8a9cc3b58e67dbd71b86fdec03c24bfb4a4f3af4b02d370802e18f4

  • SHA512

    dbd2a6ad9e02a4c8ecc44832b56f282284bee42ccb747dc9c7df300a9b6553aeebf7197e4f5278cd5a8db9a9aa6020bf26b4f08b23ec6b2a30d31195719d3632

  • SSDEEP

    1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEr7:9RkjWjK9ABpGzlaRQLe7

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Targets

    • Target

      42b61e69f8a9cc3b58e67dbd71b86fdec03c24bfb4a4f3af4b02d370802e18f4N

    • Size

      79KB

    • MD5

      92d6e1e2b8bc980b2094e6786c0292a0

    • SHA1

      ceeafcf82e0ffdc9f31f99511df177efc7052e83

    • SHA256

      42b61e69f8a9cc3b58e67dbd71b86fdec03c24bfb4a4f3af4b02d370802e18f4

    • SHA512

      dbd2a6ad9e02a4c8ecc44832b56f282284bee42ccb747dc9c7df300a9b6553aeebf7197e4f5278cd5a8db9a9aa6020bf26b4f08b23ec6b2a30d31195719d3632

    • SSDEEP

      1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEr7:9RkjWjK9ABpGzlaRQLe7

    • Urelas

      Urelas is a trojan targeting card games.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks