urelas | 2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop
Size 2.3MB
Sample260504-mexmlact2q
SHA256 3aae20179b12f402c20a72393b8be067fec89a8a61682c0214b1ce2034d0c2d0
MD5 676ca5ae940f6c24a81845fa1c1279c8
SHA1 4f26e683423e79cf9013fb3017a42103810b53b9
SHA512 bda64290b8d550d83ed2ec71ee65ba5d3a92dd4285fc9000f32663c47e09dce241d6b1947fa47b07f3ec03a87f8bbb9c6e62f371d2d30c0003627b80832face7
SSDEEP 24576:crt4/NArwjs5gAVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHpm/:9/NlI5TVmgbQIzZMPXpB91rHpu
TLSH
T17DB51753EB814AD9E38D0536DF448150972AF92997FF1260742822DCDEA3387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop

File Explorer

2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop

.exe 2.3MB

2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop

IMPHASH c655066d0a2c4420aaa11c9556e7466c
SHA256 3aae20179b12f402c20a72393b8be067fec89a8a61682c0214b1ce2034d0c2d0
MD5 676ca5ae940f6c24a81845fa1c1279c8
SHA1 4f26e683423e79cf9013fb3017a42103810b53b9
SHA512 bda64290b8d550d83ed2ec71ee65ba5d3a92dd4285fc9000f32663c47e09dce241d6b1947fa47b07f3ec03a87f8bbb9c6e62f371d2d30c0003627b80832face7
SSDEEP 24576:crt4/NArwjs5gAVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHpm/:9/NlI5TVmgbQIzZMPXpB91rHpu
TLSH
T17DB51753EB814AD9E38D0536DF448150972AF92997FF1260742822DCDEA3387BF61A3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFileAttributesW DeviceIoControl FlushFileBuffers SetFilePointer ReadFile GetFileSizeEx SetLastError LocalAlloc LocalFree LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalLock GlobalReAlloc GlobalUnlock GlobalHandle GlobalAlloc InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc CreateFileW GlobalFree TlsFree InterlockedDecrement FreeLibrary lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA lstrcmpW LoadLibraryA GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags SetEndOfFile HeapAlloc HeapFree GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate GetStdHandle SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap MultiByteToWideChar LockResource LoadResource SizeofResource FindResourceW WriteFile CreateFileA GetModuleFileNameA GetTempPathA GetModuleHandleA TerminateProcess CreateThread CreateEventW DeleteFileW GetSystemDirectoryW GetTempPathW OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep GetModuleFileNameW GetCurrentProcessId GetCurrentProcess CloseHandle GetVersionExW GetProcAddress LoadLibraryW GetModuleHandleW DeleteCriticalSection GetLastError

user32

SetWindowTextW ClientToScreen DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID CallWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx LoadStringW LoadAcceleratorsW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW RegisterWindowMessageW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetFocus

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

gethostbyaddr socket gethostbyname WSAStartup htonl WSAGetLastError recv send closesocket connect htons inet_addr

iphlpapi

GetAdaptersInfo

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject TextOutW PtVisible ScaleWindowExtEx SetWindowExtEx CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx RectVisible SetViewportOrgEx SelectObject Escape GetDeviceCaps SetMapMode

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

488KB

Virtual Size

512KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

tCGLwVWn

Size

4KB

Virtual Size

3KB

Characteristics

Name

YLVGNxCt

Size

512B

Virtual Size

258B

Characteristics

Name

HBNGFfPv

Size

3KB

Virtual Size

2KB

Characteristics

Name

vjqBWEuU

Size

14KB

Virtual Size

13KB

Characteristics

Name

vJKcFCFt

Size

1.5MB

Virtual Size

1.5MB

Characteristics

Name

uGLbgZZU

Size

197KB

Virtual Size

197KB

Characteristics

Name

XeDojibD

Size

512B

Virtual Size

446B

Characteristics

Name

EuacxBUU

Size

8KB

Virtual Size

7KB

Characteristics

Name

hOWwNNeT

Size

2KB

Virtual Size

2KB

Characteristics

Name

RojIaxwq

Size

36KB

Virtual Size

35KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

wtsapi32

oleacc

gdi32

winspool.drv

oleaut32

generic