Extracted

• • Target
    2026-06-26_161f30e5a6141671460af37ecfb8501d_amadey_elex_rhadamanthys_smoke-loader_stop_urelas
  • Size 647KB
  • SHA256 dd401e7e0231bb263e2dba541bd419f8a7b895061781285e7d42f892c278bed9
  • MD5 161f30e5a6141671460af37ecfb8501d
  • SHA1 f2d62e21d40b1766be5cc82d613186977b9b3872
  • SHA512 7e41a9de73c7504dd033c41b25c5567eae3292bca5428ffaa23b22268e31b509c0e0e73e9b5eda9db408ffde5c01d9bf87668511df7e1e62c04814ee630e3d3c
  • SSDEEP 12288:VU7M5ijWh0XOW4sEf9OTijWh0XOW4sEfwi:VUowYcOW4a2YcOW4H
  • TLSH
    T11BE4E01675408875F7290B310806FAE40AA9AD3E1AD4F54FF67CBE7968320979B3724F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2discoveryurelastrojanadwarepersistencespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2