urelas | 2026-08-22_9fd6ec01b29146ac19f6efcd1ced02ea_amadey_elex_njrat_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_9fd6ec01b29146ac19f6efcd1ced02ea_amadey_elex_njrat_rhadamanthys_smoke-loader_stop
Size 1.1MB
Sample260823-eaebfsdr3y
SHA256 cc19caa2af15c8d80ccd90c63e941684e18260e0d0eb191e783d3df565f457e8
MD5 9fd6ec01b29146ac19f6efcd1ced02ea
SHA1 fdbebfba4774c0aea73baecd9c00caa12c1429ab
SHA512 56ca8aa50d087bbda442114069979b5e6312b422ab836893f1fdc1184e83b2b4e97bdad1dd995a532264293e15fe7fa7c8dc1552f60019a84a59679fe93cd0f4
SSDEEP 12288:i6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1UTL1Jer5+n1A1Cmer5+nIwaJZer5w:i6tQCG0UUPzEkTn4AC1+wAsV
TLSH
T11345C303E6404CE6D3D90235DE50C160572AFC2D9BFB527AB55C3229FE733867E26A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_9fd6ec01b29146ac19f6efcd1ced02ea_amadey_elex_njrat_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-22_9fd6ec01b29146ac19f6efcd1ced02ea_amadey_elex_njrat_rhadamanthys_smoke-loader_stop

.exe 1.1MB

2026-08-22_9fd6ec01b29146ac19f6efcd1ced02ea_amadey_elex_njrat_rhadamanthys_smoke-loader_stop

IMPHASH 09eb18457adb53a09f3f97fc04e9e2cf
SHA256 cc19caa2af15c8d80ccd90c63e941684e18260e0d0eb191e783d3df565f457e8
MD5 9fd6ec01b29146ac19f6efcd1ced02ea
SHA1 fdbebfba4774c0aea73baecd9c00caa12c1429ab
SHA512 56ca8aa50d087bbda442114069979b5e6312b422ab836893f1fdc1184e83b2b4e97bdad1dd995a532264293e15fe7fa7c8dc1552f60019a84a59679fe93cd0f4
SSDEEP 12288:i6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1UTL1Jer5+n1A1Cmer5+nIwaJZer5w:i6tQCG0UUPzEkTn4AC1+wAsV
TLSH
T11345C303E6404CE6D3D90235DE50C160572AFC2D9BFB527AB55C3229FE733867E26A29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA lstrcmpW LoadLibraryA LoadLibraryW TlsAlloc GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA LocalReAlloc HeapAlloc HeapFree GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree VirtualAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError TlsSetValue SetFileTime CreateDirectoryW WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW ExitProcess MultiByteToWideChar CreateThread WriteFile CreateFileA GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetSystemDirectoryW GetTickCount Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetFileAttributesW GetTempPathW GetModuleFileNameW GlobalDeleteAtom GetVersionExW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW GetMessageW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx TranslateAcceleratorW TranslateMessage SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW CopyRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape TextOutW GetDeviceCaps RectVisible

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

456KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

uJGSteNN

Size

11KB

Virtual Size

11KB

Characteristics

Name

cOrtsCex

Size

4KB

Virtual Size

3KB

Characteristics

Name

NnxqHArf

Size

4KB

Virtual Size

3KB

Characteristics

Name

hoHJJamu

Size

121KB

Virtual Size

120KB

Characteristics

Name

YeObWpiJ

Size

236KB

Virtual Size

235KB

Characteristics

Name

hlkFRkEB

Size

176KB

Virtual Size

175KB

Characteristics

Name

nIOhLnnN

Size

512B

Virtual Size

269B

Characteristics

Name

LfMuUMhk

Size

123KB

Virtual Size

122KB

Characteristics

Name

YpyOCGuY

Size

3KB

Virtual Size

3KB

Characteristics

Name

LKfqMdZZ

Size

14KB

Virtual Size

13KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_9fd6ec01b29146ac19f6efcd1ced02ea_amadey_elex_njrat_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic