Extracted

• • Target
    2026-11-07_0e16f7a6c94888e0275065d21597791a_coinminer_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 658KB
  • SHA256 be023041675323fdefb1239022f966bff7af2689d8c02a965d8efffe0dc1b0e6
  • MD5 0e16f7a6c94888e0275065d21597791a
  • SHA1 dc0c5242eb6b1e9a366cd5c6f8ed804e02568f37
  • SHA512 6bed16140390d7ace7cc2ffb65c5d14514f67d636c597e5ca200d40addda0ac9293be3f4dc4c9667428b472aecca8eb154a78f306ea03549a0c7ba042be02dbb
  • SSDEEP 6144:6xBWeMRygxDLbHxlSBxzJP1REBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGDqXgN:K3MQIDKJLTq+Xxvo0U+d3s/fCX0ON
  • TLSH
    T191E4CE253680C472E3690B314425FAF10969AD3916E8E58FF7387E766E3129353B728F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionurelastrojanupx

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Custom signature

    UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2