urelas | 678ae832e230db7294fd2ae0bde8adfb226c6982337ddb787f6d0b23f8e08809

General

Target
2026-06-07_df779ee37d131611441b06514748e257_amadey_elex_rhadamanthys_smoke-loader_tofsee
Size 421KB
Sample260607-vbza1sht5j
SHA256 678ae832e230db7294fd2ae0bde8adfb226c6982337ddb787f6d0b23f8e08809
MD5 df779ee37d131611441b06514748e257
SHA1 98e57559adc3a31afa93c8033c741ba46f6b13e7
SHA512 be10d2c64a01871dbcbf3ab6129d4b9ee8399b4c016c443353e2e13ad70e194d25911e1ea5fa745f61122c0bc81e9711f65fd4b1216a1fa9cf6c6a3464edd324
SSDEEP 6144:D10dhcp406uF/LyV6W6KMZIxyabKp+wch/pkDQ7x8zmYGmIH:R0PY406CyV6WgZIxkprccDQd8yH
TLSH
T15694BE2176408079F36A0B314955E6F508A8AC3916A4E8CFF7B87E3A2D711C35A7738F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

urelas

C2

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Targets

- Target
  2026-06-07_df779ee37d131611441b06514748e257_amadey_elex_rhadamanthys_smoke-loader_tofsee
- Size 421KB
- SHA256 678ae832e230db7294fd2ae0bde8adfb226c6982337ddb787f6d0b23f8e08809
- MD5 df779ee37d131611441b06514748e257
- SHA1 98e57559adc3a31afa93c8033c741ba46f6b13e7
- SHA512 be10d2c64a01871dbcbf3ab6129d4b9ee8399b4c016c443353e2e13ad70e194d25911e1ea5fa745f61122c0bc81e9711f65fd4b1216a1fa9cf6c6a3464edd324
- SSDEEP 6144:D10dhcp406uF/LyV6W6KMZIxyabKp+wch/pkDQ7x8zmYGmIH:R0PY406CyV6WgZIxkprccDQd8yH
- TLSH
  T15694BE2176408079F36A0B314955E6F508A8AC3916A4E8CFF7B87E3A2D711C35A7738F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery urelas trojan upx
- Family: Urelas
  Urelas is a trojan targeting card games.
  trojan urelas
- Detects executables built or packed with MPress PE compressor
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Urelas

Detects executables built or packed with MPress PE compressor

UPX dump on OEP (original entry point)

Checks computer location settings

Executes dropped EXE

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2