urelas | 2026-11-01_c51bf13cdc2e3cec3be9028d4de1f967_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c51bf13cdc2e3cec3be9028d4de1f967_amadey_elex_rhadamanthys_smoke-loader_stop
Size 502KB
Sample261102-k76d4assgx
SHA256 291aa1375e419655cb3ba61e851cdaf4c360f56f8900c8429388247a6d888cf2
MD5 c51bf13cdc2e3cec3be9028d4de1f967
SHA1 a402b9629d12311886cac14ced022e414b4ae1d2
SHA512 a891e59bcbaf9f9f5ca5e8368b8056fee6ec985271944281431d259a81f9ac1651d0426b1def3ec80eb2f41e77fcb656cbdbcd965b2b9d3ae6bf81382e61b66c
SSDEEP 6144:/S4Oq+xNofxkNYFQQG8SdrL9Ti5v4gFcFhN87tW6cvC0WMQbv6FumphcKTtT1ZPH:fwYFQQG8SdrNa4gFK0IqXOFumphcKTpr
TLSH
T1CAB4C0213690C435E3A613764996E6B419997E345AA0D28FF7B83E799F301C39A3334F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c51bf13cdc2e3cec3be9028d4de1f967_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-01_c51bf13cdc2e3cec3be9028d4de1f967_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 502KB

2026-11-01_c51bf13cdc2e3cec3be9028d4de1f967_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 85158b3a2348219a454e0ea5bcf288b8
SHA256 291aa1375e419655cb3ba61e851cdaf4c360f56f8900c8429388247a6d888cf2
MD5 c51bf13cdc2e3cec3be9028d4de1f967
SHA1 a402b9629d12311886cac14ced022e414b4ae1d2
SHA512 a891e59bcbaf9f9f5ca5e8368b8056fee6ec985271944281431d259a81f9ac1651d0426b1def3ec80eb2f41e77fcb656cbdbcd965b2b9d3ae6bf81382e61b66c
SSDEEP 6144:/S4Oq+xNofxkNYFQQG8SdrL9Ti5v4gFcFhN87tW6cvC0WMQbv6FumphcKTtT1ZPH:fwYFQQG8SdrNa4gFK0IqXOFumphcKTpr
TLSH
T1CAB4C0213690C435E3A613764996E6B419997E345AA0D28FF7B83E799F301C39A3334F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20131004)\GolfProject\bin\GolfProject.pdb

kernel32

lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA lstrcmpW LoadLibraryA LoadLibraryW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags InterlockedDecrement SetEndOfFile GetCurrentProcess GetModuleHandleA HeapAlloc HeapFree GetStartupInfoW RtlUnwind RaiseException HeapReAlloc GetCurrentProcessId TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree VirtualAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap GetProcAddress TlsFree GlobalFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError HeapSize FreeLibrary SetFileTime CreateDirectoryW WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW ExitProcess MultiByteToWideChar CreateThread WriteFile CreateFileA GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetSystemDirectoryW GetTickCount Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetFileAttributesW GetTempPathW GetModuleFileNameW FlushFileBuffers GetVersionExW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW RegisterWindowMessageW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu GetClientRect PostMessageW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID CallWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect GetMenuState wsprintfW LoadIconW LoadCursorW RegisterClassExW GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId SendMessageW GetParent ClientToScreen CreateWindowExW DefWindowProcW BeginPaint EndPaint PostQuitMessage SetWindowTextW SetForegroundWindow UnhookWindowsHookEx MessageBoxW EnableWindow GetWindowLongW GetLastActivePopup IsWindowEnabled

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

recv send closesocket connect htons inet_addr gethostbyname socket gethostbyaddr htonl WSAStartup WSAGetLastError

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject SetWindowExtEx ScaleViewportExtEx ExtTextOutW SaveDC RestoreDC SetMapMode ScaleWindowExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape RectVisible GetDeviceCaps PtVisible TextOutW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

182KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

255KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

OKJHG

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c51bf13cdc2e3cec3be9028d4de1f967_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic