Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4ab5a7a21ee8943b1e78513e20dc25f0_JaffaCakes118

  • Size

    329KB

  • Sample

    241020-zycsrasbjq

  • MD5

    4ab5a7a21ee8943b1e78513e20dc25f0

  • SHA1

    b80f2bfcd47e38d520f88263907080282ec64dd5

  • SHA256

    4c1497ab75a29dc8fbbffa6d4cefe6629f43bdbec9f6cdb08c450a6e89d0871c

  • SHA512

    c520d80b17352b582418b35a0e3efd4b35a835b771517ae3e3c91a5b2c332bf5b21af8ae7b9ce665692b15f47b6476a1c1a0318e95ac987c1543ea9ee77a32e7

  • SSDEEP

    3072:NdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisB:Nd7rpL43btmQ58Z27zw39gY2FeZhp

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Targets

    • Target

      4ab5a7a21ee8943b1e78513e20dc25f0_JaffaCakes118

    • Size

      329KB

    • MD5

      4ab5a7a21ee8943b1e78513e20dc25f0

    • SHA1

      b80f2bfcd47e38d520f88263907080282ec64dd5

    • SHA256

      4c1497ab75a29dc8fbbffa6d4cefe6629f43bdbec9f6cdb08c450a6e89d0871c

    • SHA512

      c520d80b17352b582418b35a0e3efd4b35a835b771517ae3e3c91a5b2c332bf5b21af8ae7b9ce665692b15f47b6476a1c1a0318e95ac987c1543ea9ee77a32e7

    • SSDEEP

      3072:NdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisB:Nd7rpL43btmQ58Z27zw39gY2FeZhp

    • Urelas

      Urelas is a trojan targeting card games.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks