urelas | 2026-08-03_8f2d6a7ca7e8b9f68abe2f80b7e2efa2_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_8f2d6a7ca7e8b9f68abe2f80b7e2efa2_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop
Size 1.7MB
Sample260804-mxtnnatxdx
SHA256 693be929d7b0c320fd93511b0740ea83d8f7d7cc826a823cad802c9425638506
MD5 8f2d6a7ca7e8b9f68abe2f80b7e2efa2
SHA1 7504fb90d67af1f34b4f51011810edb9abdd6ab8
SHA512 127b6eccf20d2aba1d4d2ef8bd9f092078f6f5194f68895e25ff4cce10d84ffa39710fa6b587c0b0a108ca26a968515e6a9686a3444c144e1361851b2c73d414
SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeq:L7dLBeU9g16AVDKUTbQIzFLwr0
TLSH
T1FC850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_8f2d6a7ca7e8b9f68abe2f80b7e2efa2_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-03_8f2d6a7ca7e8b9f68abe2f80b7e2efa2_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

.exe 1.7MB

2026-08-03_8f2d6a7ca7e8b9f68abe2f80b7e2efa2_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

IMPHASH 00d8178937161dc240e0095e46c6ce52
SHA256 693be929d7b0c320fd93511b0740ea83d8f7d7cc826a823cad802c9425638506
MD5 8f2d6a7ca7e8b9f68abe2f80b7e2efa2
SHA1 7504fb90d67af1f34b4f51011810edb9abdd6ab8
SHA512 127b6eccf20d2aba1d4d2ef8bd9f092078f6f5194f68895e25ff4cce10d84ffa39710fa6b587c0b0a108ca26a968515e6a9686a3444c144e1361851b2c73d414
SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeq:L7dLBeU9g16AVDKUTbQIzFLwr0
TLSH
T1FC850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateEventW CreateThread GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer OpenEventW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CopyFileW GetTempPathW GetFileAttributesW Sleep GetTickCount ExitProcess FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP HeapCreate HeapDestroy HeapReAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW DestroyWindow DefWindowProcW EndDialog PostQuitMessage EndPaint BeginPaint

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

htonl connect WSAGetLastError recv send WSAStartup closesocket gethostbyaddr socket gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

Name

.text

Size

105KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

JHDFRWG

Size

50KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ggdBeuax

Size

42KB

Virtual Size

42KB

Characteristics

Name

jOiXNNrv

Size

4KB

Virtual Size

3KB

Characteristics

Name

EIDjRPCe

Size

5KB

Virtual Size

4KB

Characteristics

Name

uIbBQPZm

Size

87KB

Virtual Size

87KB

Characteristics

Name

rqXoJdNw

Size

1.0MB

Virtual Size

1.0MB

Characteristics

Name

TkjmuZsA

Size

90KB

Virtual Size

90KB

Characteristics

Name

LUIdoHLM

Size

1024B

Virtual Size

948B

Characteristics

Name

YrOnpNVH

Size

24KB

Virtual Size

24KB

Characteristics

Name

eTlunOhK

Size

2KB

Virtual Size

2KB

Characteristics

Name

udzUMJdp

Size

95KB

Virtual Size

95KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_8f2d6a7ca7e8b9f68abe2f80b7e2efa2_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

generic