urelas | 2026-05-11_1ff4b4aae8def2a5230e9b4e931939a0_amadey_elex_karagany_rhadamanthys_smoke-loader_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_1ff4b4aae8def2a5230e9b4e931939a0_amadey_elex_karagany_rhadamanthys_smoke-loader_tofsee
Size 383KB
Sample260511-bfdekact6q
SHA256 488c0f875a2227d2c26dd9c1cc9156991c852117dbe5920001eecc6d684135cb
MD5 1ff4b4aae8def2a5230e9b4e931939a0
SHA1 24490a574f3628d30d5f94cd8ca638ab3d242c1b
SHA512 6d6654378513234b95f972be4f7ebe974db82683e4903f11ad5570d768bee38914b7f393896d756bb9d39e91c4c91271121a9e61584b4faffc405439993c9d6a
SSDEEP 6144:Rsa1jZVgy03se0kX1bewB1TY8BcA18rhyzypLZhF5D/e1M8p/dbO:3tVgyusetedUfzeLl5DmMqbO
TLSH
T16D84BE2172408039F3690B3149A5E6F5186DAD3927A4E98FF7783E3A2E711C3567728F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_1ff4b4aae8def2a5230e9b4e931939a0_amadey_elex_karagany_rhadamanthys_smoke-loader_tofsee

File Explorer

2026-05-11_1ff4b4aae8def2a5230e9b4e931939a0_amadey_elex_karagany_rhadamanthys_smoke-loader_tofsee

.exe 383KB

2026-05-11_1ff4b4aae8def2a5230e9b4e931939a0_amadey_elex_karagany_rhadamanthys_smoke-loader_tofsee

IMPHASH b6852ed4e334147c4929ea4ff7285899
SHA256 488c0f875a2227d2c26dd9c1cc9156991c852117dbe5920001eecc6d684135cb
MD5 1ff4b4aae8def2a5230e9b4e931939a0
SHA1 24490a574f3628d30d5f94cd8ca638ab3d242c1b
SHA512 6d6654378513234b95f972be4f7ebe974db82683e4903f11ad5570d768bee38914b7f393896d756bb9d39e91c4c91271121a9e61584b4faffc405439993c9d6a
SSDEEP 6144:Rsa1jZVgy03se0kX1bewB1TY8BcA18rhyzypLZhF5D/e1M8p/dbO:3tVgyusetedUfzeLl5DmMqbO
TLSH
T16D84BE2172408039F3690B3149A5E6F5186DAD3927A4E98FF7783E3A2E711C3567728F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx CloseHandle GetSystemDirectoryW GetTempPathW GetFileAttributesW GetTickCount GetLastError ReadFile SetFilePointer WriteFile FlushFileBuffers CreateFileA DeviceIoControl Sleep SetFileAttributesW DeleteFileW GetCurrentProcessId TerminateProcess GetProcAddress GetTempPathA GetModuleFileNameA SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateFileW OpenEventW CreateEventW CreateThread SetEndOfFile HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetVersionExW MultiByteToWideChar FreeResource LockResource LoadResource SizeofResource GetModuleFileNameW FindResourceW IsProcessorFeaturePresent DeleteCriticalSection GetFileType SetHandleCount GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle GetConsoleMode GetConsoleCP RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW ExitProcess InterlockedDecrement GetCurrentThreadId HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetProcessHeap

user32

LoadCursorW RegisterClassExW LoadStringW wsprintfW LoadIconW CreateWindowExW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

htonl gethostbyaddr WSAStartup socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersInfo