General

  • Target

    7515b2147561e5a85c0c0802b448fbe2_JaffaCakes118

  • Size

    632KB

  • Sample

    241024-17b39awbpf

  • MD5

    7515b2147561e5a85c0c0802b448fbe2

  • SHA1

    c77692f63340d8e70435449e1194580919b0bdc4

  • SHA256

    a84afe713461d85328a8585952ebc864e9bbf5d0bb8122624190e19528356a37

  • SHA512

    e059640d79a36489fbef3eaacfff9655e0c7e6d246579530affbe9c0bc61e47e38277826ac31f6c14e0a9464f1ea5776572e6a346470250fbb0668cfff9c25da

  • SSDEEP

    12288:RU7M5ijWh0XOW4sEf9OTijWh0XOW4sEfsW:RUowYcOW4a2YcOW4X

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Targets

    • Target

      7515b2147561e5a85c0c0802b448fbe2_JaffaCakes118

    • Size

      632KB

    • MD5

      7515b2147561e5a85c0c0802b448fbe2

    • SHA1

      c77692f63340d8e70435449e1194580919b0bdc4

    • SHA256

      a84afe713461d85328a8585952ebc864e9bbf5d0bb8122624190e19528356a37

    • SHA512

      e059640d79a36489fbef3eaacfff9655e0c7e6d246579530affbe9c0bc61e47e38277826ac31f6c14e0a9464f1ea5776572e6a346470250fbb0668cfff9c25da

    • SSDEEP

      12288:RU7M5ijWh0XOW4sEf9OTijWh0XOW4sEfsW:RUowYcOW4a2YcOW4X

    • Urelas

      Urelas is a trojan targeting card games.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks