Extracted

• • Target
    2026-07-01_ce93ea0cff00ff1d5b2e13a62e177b0d_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.4MB
  • SHA256 333d748831c8217e713055e512873dbee011b901a6b8b3da7898eee96a3f6f9b
  • MD5 ce93ea0cff00ff1d5b2e13a62e177b0d
  • SHA1 dbde98c77429b4d27984f83651e88760d6a6eccd
  • SHA512 d970f9b4eef5a3f3975d1b37cb333b4ca4086b0e9b3309688588525966ff8fd7003b537df446f2a1e4a0077cd9a87a35eb1c1475646295a50c14d4d4bdf40c62
  • SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMP:AIfjoga6u1AVDP
  • TLSH
    T10365D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistenceransomwarespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2