Extracted

• • Target
    2026-04-21_2cd8f3b8ffeb0568b73c84d50f247654_coinminer_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 662KB
  • SHA256 bde058b0fdb494ed0bb78c08f7c7f9721da5b6c36e9cc8f6a2a8ae7244091f15
  • MD5 2cd8f3b8ffeb0568b73c84d50f247654
  • SHA1 17334779edd9b2a99a1f400414b906560a410b6e
  • SHA512 ac15c9cd1395df46e17bb8ce2c0f4ccef0f8cdf0ad05ea7b232094baa1fabd3bdb66e9764bc343306cdd1e5a521faa556ebf9435c02c339686a2457bf3c7930f
  • SSDEEP 6144:O1xBWeMRygxDLbHxlSBxzJn1REBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGDqL0:Ol3MQIDKJzTq+Xxvo0U+d3s/fCX0G
  • TLSH
    T1CDE4CE253680C476E36A1B314421EAF10D69AD3916E8E58FF3387E765E312D3527B28F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanupx

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Custom signature

    UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2