Extracted

• • Target
    2026-07-03_668de4b7afa52d8803aec52b159196e5_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 1.4MB
  • SHA256 2a265f3f3cf88905006e38d6821d83037e841124b219376e99e4305f74503164
  • MD5 668de4b7afa52d8803aec52b159196e5
  • SHA1 2d463b00cae74a3b19cd37683506b453690db49d
  • SHA512 5f52b0de8d3997d23535f46ea337741cce1b7be365c317d34b8ec3d13803252799248249b0517bf1c825f782d819c740020623987d92f3414d2be8368642963d
  • SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMF:AIfjoga6u1AVDF
  • TLSH
    T1AE65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistenceransomwarespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2