Extracted

• • Target
    2026-07-05_ac35635bbdf6069d23a85335702f7d6f_darkgate_elex_smoke-loader
  • Size 2.2MB
  • SHA256 c0be82ca7c553e4a42a6cdd49c0604dd611cc9786a3a9a271720f6f50dfa5866
  • MD5 ac35635bbdf6069d23a85335702f7d6f
  • SHA1 5e9c474ba5b2cfec2ecb9a97ebec37cebc88baf2
  • SHA512 0d35cefaf2cef83c1e1f2ae913eebd3ac1ca79727623f9138eaccb638d7ad088b99ed06a8a75d841a15ee42d75465fd8556eb0ae9f065561de2073dee24e6346
  • SSDEEP 49152:tmgqWDlmt+OCi1NqvNgyhIZ0tFYh1W1rJ/c8cifaE9+WagVGhUETtHWSQLQRQucC:pqimt+Ov1eNgyhIZ0tFYh1QrpaE97agU
  • TLSH
    T1D4B5BF2936A18076CA3339314A4EF3B9F6B9AD704935022767A03E3C2E715935D2977F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistenceransomwarespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2