Extracted

• • Target
    2026-11-09_f605bcdbd199c1235d4448509f1ad196_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 464KB
  • SHA256 71d2d73cc6d6bf637e870400e29bc7c942b8aaa5aefd631c14fc3c432dd3faed
  • MD5 f605bcdbd199c1235d4448509f1ad196
  • SHA1 24f5ca28be990343e3c32979b8e8ff2f0cc14a87
  • SHA512 4ea6ba36c2184c64a92c90e4abe75da79a528d2d5260ebf93f548db52bcf98b4f879dfffacac530c50e6cc545a4d0a1d820c32ad6a718c7054c4f1597589caf9
  • SSDEEP 6144:E9H4y9VOpL/DrRRoSGFPRuDYBzFrY5dRA2AkCMnZi6c/2AS9kFwJAReRH27:EZF9VOpn7oSG1EcBhs9xAkLZMoY7
  • TLSH
    T123A4DF113640C035E36A0B314995FAF049A8AD3915E8E94FF7787E3A5E712839B7B24F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionurelastrojanupx

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Custom signature

    UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2