Extracted

• • Target
    2026-06-28_78fe84b3e36aed937582c4b5d3ddc26e_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
  • Size 647KB
  • SHA256 27b369cac76058612338013a63415a23053c1a51ac3c59a2df8ee0241b01698c
  • MD5 78fe84b3e36aed937582c4b5d3ddc26e
  • SHA1 9f57f06182ee5a0e1233af62f88b7e3359025998
  • SHA512 3ae39d4940d06f143f4ae4f3cf8630703c145d0221b8dc1acd5999db3e1a8b876b35b80f77ba852f1abd0214bb4a7dc5e0c3342f13387d64d92171be3d622a40
  • SSDEEP 12288:VU7M5ijWh0XOW4sEf9OTijWh0XOW4sEfww:VUowYcOW4a2YcOW4Z
  • TLSH
    T1E4E4E01675408475F7290B320806FAE40AA9AD3E1AD4F54FF67CBE7968320979B3724F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2discoveryurelastrojanadwarepersistenceransomwarespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2