Extracted

• • Target
    2026-07-01_1f62816b74416d2ceab086c811cf897a_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.4MB
  • SHA256 2e8ca3f4be6f13c3e46a558f274f2e5d1e54b25e7745db70e75e5d456f127a13
  • MD5 1f62816b74416d2ceab086c811cf897a
  • SHA1 1e50035788c6e33844e9e2d8edff60006fd601a0
  • SHA512 72e7d28f1871ce6ff0b9f01e36ca29e4e06485713339b899f6fcf117b050fb86d31f1c3d996c7bc7a7ec8e15793f85abb2a44c8f2be8d3440054a63fa248fef3
  • SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMx:AIfjoga6u1AVDx
  • TLSH
    T10865D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistenceransomwarespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2