urelas | 2026-06-09_dbb524a0a9a5c05a1ca7e7fd438ea3fd_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-09_dbb524a0a9a5c05a1ca7e7fd438ea3fd_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
Size 3.7MB
Sample260609-2p2fvsbt9r
SHA256 c8df9513dd034e8726ef740ab4962ac69c0d269baaf2a56189e297ef7d2a0963
MD5 dbb524a0a9a5c05a1ca7e7fd438ea3fd
SHA1 19169fb26afd3b57c9a5ad775153d29dc60ea323
SHA512 0ecc1b7722baf8cd4af1707377df4e1974abb446a97cdf10dd00319355c8595c651439d71850ce5c2faf5e4dac893b290ee9fe4affff6e69822364d4dfac08d8
SSDEEP 98304:bQH0UinLrHp/qKm2/Sb/gqAZj+UzKb3Htq:UH2rRb/G8+I
TLSH
T10E068C13EB814AE8F38D05365B548140D72AEE22964F1361746C326DDFB73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-09_dbb524a0a9a5c05a1ca7e7fd438ea3fd_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-06-09_dbb524a0a9a5c05a1ca7e7fd438ea3fd_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

.exe 3.7MB

2026-06-09_dbb524a0a9a5c05a1ca7e7fd438ea3fd_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

IMPHASH 09eb18457adb53a09f3f97fc04e9e2cf
SHA256 c8df9513dd034e8726ef740ab4962ac69c0d269baaf2a56189e297ef7d2a0963
MD5 dbb524a0a9a5c05a1ca7e7fd438ea3fd
SHA1 19169fb26afd3b57c9a5ad775153d29dc60ea323
SHA512 0ecc1b7722baf8cd4af1707377df4e1974abb446a97cdf10dd00319355c8595c651439d71850ce5c2faf5e4dac893b290ee9fe4affff6e69822364d4dfac08d8
SSDEEP 98304:bQH0UinLrHp/qKm2/Sb/gqAZj+UzKb3Htq:UH2rRb/G8+I
TLSH
T10E068C13EB814AE8F38D05365B548140D72AEE22964F1361746C326DDFB73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA lstrcmpW LoadLibraryA LoadLibraryW TlsAlloc GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA LocalReAlloc HeapAlloc HeapFree GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree VirtualAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError TlsSetValue SetFileTime CreateDirectoryW WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW ExitProcess MultiByteToWideChar CreateThread WriteFile CreateFileA GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetSystemDirectoryW GetTickCount Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetFileAttributesW GetTempPathW GetModuleFileNameW GlobalDeleteAtom GetVersionExW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW GetMessageW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx TranslateAcceleratorW TranslateMessage SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW CopyRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape TextOutW GetDeviceCaps RectVisible

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

456KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

TLRzHMLX

Size

90KB

Virtual Size

90KB

Characteristics

Name

PuIlZgMJ

Size

512B

Virtual Size

381B

Characteristics

Name

uraBNgeD

Size

4KB

Virtual Size

4KB

Characteristics

Name

QaBhoDkX

Size

9KB

Virtual Size

9KB

Characteristics

Name

jIdtNzhi

Size

3.0MB

Virtual Size

3.0MB

Characteristics

Name

vYkbFwOO

Size

56KB

Virtual Size

56KB

Characteristics

Name

vMDDmfih

Size

2KB

Virtual Size

2KB

Characteristics

Name

xoRDWEAQ

Size

9KB

Virtual Size

9KB

Characteristics

Name

pVKRazYU

Size

2KB

Virtual Size

1KB

Characteristics

Name

vbRFMmvN

Size

11KB

Virtual Size

10KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-09_dbb524a0a9a5c05a1ca7e7fd438ea3fd_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic