Extracted

• • Target
    2026-07-06_1ea323f88d804dbca0aaf74f7815daa3_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 402KB
  • SHA256 8492adc252029d4f659ed7f378f70ed648a09148637f0464f7e6b6f14c1523a3
  • MD5 1ea323f88d804dbca0aaf74f7815daa3
  • SHA1 41dfe87de42c3147212c7fdcce58e19ff27345d2
  • SHA512 9d0179c488a368f90f39be52a69d2155916976bb68ca55ae91505527e5baf76f1c47b3014f67ca305dbd95b76ca124b7a39a018e6f817858a1c846a3b6415cd4
  • SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvE4:yIfBoDWoyFboU6hAJQnrQ
  • TLSH
    T1BB94BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistencespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2