Extracted

• • Target
    2026-07-06_b7cdef910f17e24bf9b5c1fc15ab118f_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 592KB
  • SHA256 fc1986e75afcbf26f8332a912298d94c4a9ec80f471bc23b0eaec75ba58e4281
  • MD5 b7cdef910f17e24bf9b5c1fc15ab118f
  • SHA1 0c01a2571a7f68a3a7880eef7e773e1a4b5ab7eb
  • SHA512 240dfd8114b78d28c5dab498da5df30ff964d3b356e63c9282d87051434cea4653ae9e42ad8cd29aa3456faca23d2bfeb900095fbfc24cfa3963bb253570b49e
  • SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMO:8MpASIcWYx2U6hAJQnhO
  • TLSH
    T155D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryurelastrojanadwarepersistencespyware

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2