General

  • Target

    b8cd6077abb0ae94e1233912a522ec5dade181d5875fe43255abdd2e1d6ca051N.exe

  • Size

    76KB

  • Sample

    241217-mlrd6axkhv

  • MD5

    3452d1e1a15432ce9014835f7bbed8b0

  • SHA1

    f9f12d3b67d48e8e2e09bb98c7863a7fc9dcc7e6

  • SHA256

    b8cd6077abb0ae94e1233912a522ec5dade181d5875fe43255abdd2e1d6ca051

  • SHA512

    aa93194982d55883788122d632f29cb9d5dd6ee54a346e6fcbdb6eda0e4173e7fd2a8a859db529cbce8879208fef6aa9681572f7466e8ce318739e0529d0b3ca

  • SSDEEP

    1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEs:9RkjWjK9ABpGzlaRQLL

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Targets

    • Target

      b8cd6077abb0ae94e1233912a522ec5dade181d5875fe43255abdd2e1d6ca051N.exe

    • Size

      76KB

    • MD5

      3452d1e1a15432ce9014835f7bbed8b0

    • SHA1

      f9f12d3b67d48e8e2e09bb98c7863a7fc9dcc7e6

    • SHA256

      b8cd6077abb0ae94e1233912a522ec5dade181d5875fe43255abdd2e1d6ca051

    • SHA512

      aa93194982d55883788122d632f29cb9d5dd6ee54a346e6fcbdb6eda0e4173e7fd2a8a859db529cbce8879208fef6aa9681572f7466e8ce318739e0529d0b3ca

    • SSDEEP

      1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEs:9RkjWjK9ABpGzlaRQLL

    • Urelas

      Urelas is a trojan targeting card games.

    • Urelas family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks