Extracted

• • Target
    2026-06-29_c6d1801a2d3c0fb8b4874404ba00dd12_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.4MB
  • SHA256 0b60cb9ee48a8953a2bc05aeeb4e66eda0d763ff5811d8542e8244485568a93a
  • MD5 c6d1801a2d3c0fb8b4874404ba00dd12
  • SHA1 bafe6daa797255af7cca8a376959e6cb1b36ef15
  • SHA512 d703187385d9149c3f40eabc1f9cf1a734b5beb60cccc27604a073a0d0cdcf0c7463ff8612fc2f60cdc302ebfefe9aedcf56097234a9cc9e88300a317c69a3a2
  • SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMr:AIfjoga6u1AVDr
  • TLSH
    T18965D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistencespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2