urelas | 2026-11-03_985ee989403f44fb082d82b0e7d5732d_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_985ee989403f44fb082d82b0e7d5732d_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee
Size 364KB
Sample261104-qdw68ade95
SHA256 571f53ea83c218a319aeb45514343d3ded5137f6a6b436e4d793624c6adfce2b
MD5 985ee989403f44fb082d82b0e7d5732d
SHA1 55a12a32bf2cbac14466a3be28326ec2e0c1b5f7
SHA512 328bd2471628772874ca605edc0a099ef05aad38ec829f0e3793336b87beff538471d2562f95b939f6f2363815ddfb0c2b6a3e55c57b10b33c41dde9c6018de2
SSDEEP 6144:1o3whi+1Py3V0a24kOn+Sr72iyjmhuKtUYiw52hVOcvBRMHkWYHpD:YKf1PyKa2anKjm3OYZ2hocvHR
TLSH
T14B84AD246240807AF36A0B3059A5E6E5486C7C391BA4E48FF778BE391D701D39A7739F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_985ee989403f44fb082d82b0e7d5732d_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-11-03_985ee989403f44fb082d82b0e7d5732d_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee

.exe 364KB

2026-11-03_985ee989403f44fb082d82b0e7d5732d_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH b6852ed4e334147c4929ea4ff7285899
SHA256 571f53ea83c218a319aeb45514343d3ded5137f6a6b436e4d793624c6adfce2b
MD5 985ee989403f44fb082d82b0e7d5732d
SHA1 55a12a32bf2cbac14466a3be28326ec2e0c1b5f7
SHA512 328bd2471628772874ca605edc0a099ef05aad38ec829f0e3793336b87beff538471d2562f95b939f6f2363815ddfb0c2b6a3e55c57b10b33c41dde9c6018de2
SSDEEP 6144:1o3whi+1Py3V0a24kOn+Sr72iyjmhuKtUYiw52hVOcvBRMHkWYHpD:YKf1PyKa2anKjm3OYZ2hocvHR
TLSH
T14B84AD246240807AF36A0B3059A5E6E5486C7C391BA4E48FF778BE391D701D39A7739F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20130805)\Update_2010\bin\Update_2010.pdb

kernel32

GetFileSizeEx CloseHandle GetSystemDirectoryW GetTempPathW GetFileAttributesW GetTickCount GetLastError ReadFile SetFilePointer WriteFile FlushFileBuffers CreateFileA DeviceIoControl Sleep SetFileAttributesW DeleteFileW GetCurrentProcessId TerminateProcess GetProcAddress GetTempPathA GetModuleFileNameA SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateFileW OpenEventW CreateEventW CreateThread SetEndOfFile HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetVersionExW MultiByteToWideChar FreeResource LockResource LoadResource SizeofResource GetModuleFileNameW FindResourceW IsProcessorFeaturePresent DeleteCriticalSection GetFileType SetHandleCount GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle GetConsoleMode GetConsoleCP RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW ExitProcess InterlockedDecrement GetCurrentThreadId HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetProcessHeap

user32

LoadCursorW RegisterClassExW LoadStringW wsprintfW LoadIconW CreateWindowExW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

htonl gethostbyaddr WSAStartup socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersInfo

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

214KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

UGFDWSE

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_985ee989403f44fb082d82b0e7d5732d_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

generic