Extracted

• • Target
    2026-06-28_609728a1804905219f7ec067f8a59c4f_elex_rhadamanthys_stop
  • Size 1.6MB
  • SHA256 431312126689488e30c7d5e788852a5734a6daf1045493bb778a9749ce23235e
  • MD5 609728a1804905219f7ec067f8a59c4f
  • SHA1 7491a4ac36ad6d57b3fe62643963ab69e57aac4f
  • SHA512 42237879ecfe77f55f79a348cd0a6777ba3ebc9b3cf8ac0dbba5d44c689b43d7b99f352e5c312d28fb6e7b9175302d847cfb6623ad876185cacb4696f5f420c8
  • SSDEEP 12288:Q3CtSokfFGUMKwlTIU/b37dJ75WEe+eKTxB6mn:Qx9GzHlTv/b35tecFB6Q
  • TLSH
    T183853811156AF321EA912630887EB158C5A5BCA487FC51FBBD5C3AE4C733BE3753A209
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistenceransomwarespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2