urelas | 2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop
Size 785KB
Sample261102-dbj3naev51
SHA256 630f3165556635260dc150f9f4d546eecb93b42c1a3c3963cd673c12acc5f6f8
MD5 f62fe1e051fa5bc86f9df647df7cecd3
SHA1 e6559fcde328ac9f0e0b268c83f3ebf3d5d3a065
SHA512 6133d566313470a3a365c05c5ffce966e5a5689f54fc8ae613c3e91ddb20b28734d58a2b1c55173baf56ca1cea6713c1504dd2d127cd6c6a87b87fbfa9eb42f2
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgL:d7dLBftJLW5YUWLrkJB0PJgL
TLSH
T1950501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 785KB

2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 00d8178937161dc240e0095e46c6ce52
SHA256 630f3165556635260dc150f9f4d546eecb93b42c1a3c3963cd673c12acc5f6f8
MD5 f62fe1e051fa5bc86f9df647df7cecd3
SHA1 e6559fcde328ac9f0e0b268c83f3ebf3d5d3a065
SHA512 6133d566313470a3a365c05c5ffce966e5a5689f54fc8ae613c3e91ddb20b28734d58a2b1c55173baf56ca1cea6713c1504dd2d127cd6c6a87b87fbfa9eb42f2
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgL:d7dLBftJLW5YUWLrkJB0PJgL
TLSH
T1950501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with ASPack
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateEventW CreateThread GetSystemDirectoryW DeleteFileW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer OpenEventW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CopyFileW GetTempPathW GetFileAttributesW Sleep GetTickCount ExitProcess FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException GetConsoleMode GetConsoleCP HeapCreate HeapDestroy HeapReAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW wsprintfW DialogBoxParamW DestroyWindow DefWindowProcW EndDialog PostQuitMessage EndPaint BeginPaint

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

htonl connect WSAGetLastError recv send WSAStartup closesocket gethostbyaddr socket gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

Name

.text

Size

105KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

644KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

generic