urelas | 2026-11-09_c7bc0fd01e4854c23569394740190631_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_c7bc0fd01e4854c23569394740190631_amadey_elex_rhadamanthys_smoke-loader_stop
Size 598KB
Sample261109-x591qaet2x
SHA256 ae2f5517c3b17a05595197273e164f0e30d3fc56fcbba39052477a304b87c45f
MD5 c7bc0fd01e4854c23569394740190631
SHA1 398395b01a8d5e726a3028490779ce59263d7b46
SHA512 785c306c73f16ad66ac8577e532bddf5bd20a98d3f04ff3d08997b1acfc0de2ec4a3b4f1bfa2bdf64dd40a70bac67108e957ffcfcf9e23e3d3469c3944677f6e
SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpBz:MU7MLb4BQkntwNjqde
TLSH
T1C1D4CF263580C436F72A07364441E6F00AA9AC3D19D9E54FF7B87E7969311A78B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_c7bc0fd01e4854c23569394740190631_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-09_c7bc0fd01e4854c23569394740190631_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 598KB

2026-11-09_c7bc0fd01e4854c23569394740190631_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 ae2f5517c3b17a05595197273e164f0e30d3fc56fcbba39052477a304b87c45f
MD5 c7bc0fd01e4854c23569394740190631
SHA1 398395b01a8d5e726a3028490779ce59263d7b46
SHA512 785c306c73f16ad66ac8577e532bddf5bd20a98d3f04ff3d08997b1acfc0de2ec4a3b4f1bfa2bdf64dd40a70bac67108e957ffcfcf9e23e3d3469c3944677f6e
SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpBz:MU7MLb4BQkntwNjqde
TLSH
T1C1D4CF263580C436F72A07364441E6F00AA9AC3D19D9E54FF7B87E7969311A78B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification