urelas | 2026-11-09_81b51bbcd6742492007812d5514eda6a_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_81b51bbcd6742492007812d5514eda6a_elex_rhadamanthys_stop
Size 464KB
Sample261110-rqxtysvsft
SHA256 86ae4397df47ea29c91d3c526ef86f20522c4bfd8b13e7e25c1775c027738ed8
MD5 81b51bbcd6742492007812d5514eda6a
SHA1 fc56b8e7887609d79aa90ecb0815d115c719c623
SHA512 648391a91f360d74d41326e5d79df1b32b5596049623a2e1d9864f6475ad79c607f81c1a3d11c4f15c90a472c9936135a94fa649d56b72f1b14df12b173ffb16
SSDEEP 6144:P8Eoe/IebBVMweZGhHdJBV70FVKLbfW2x8VyMsmD6gzOmjpi+pMJQ8uUm9unpmZ:vDdUGhHdJ370FVKmP0Ml+gzzjp+lsuk
TLSH
T18FA4C0153680C472E36627314996E2F11AAABC3959A4E68FF7A43E396D31183873724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_81b51bbcd6742492007812d5514eda6a_elex_rhadamanthys_stop

File Explorer

2026-11-09_81b51bbcd6742492007812d5514eda6a_elex_rhadamanthys_stop

.exe 464KB

2026-11-09_81b51bbcd6742492007812d5514eda6a_elex_rhadamanthys_stop

IMPHASH 0ed9bb83b46883e5a2e5037acb0b0efe
SHA256 86ae4397df47ea29c91d3c526ef86f20522c4bfd8b13e7e25c1775c027738ed8
MD5 81b51bbcd6742492007812d5514eda6a
SHA1 fc56b8e7887609d79aa90ecb0815d115c719c623
SHA512 648391a91f360d74d41326e5d79df1b32b5596049623a2e1d9864f6475ad79c607f81c1a3d11c4f15c90a472c9936135a94fa649d56b72f1b14df12b173ffb16
SSDEEP 6144:P8Eoe/IebBVMweZGhHdJBV70FVKLbfW2x8VyMsmD6gzOmjpi+pMJQ8uUm9unpmZ:vDdUGhHdJ370FVKmP0Ml+gzzjp+lsuk
TLSH
T18FA4C0153680C472E36627314996E2F11AAABC3959A4E68FF7A43E396D31183873724F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20131216)\GolfUpdate\bin\GolfUpdate.pdb

kernel32

TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA GlobalUnlock LoadLibraryA LoadLibraryW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA InitializeCriticalSection GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError GlobalAlloc GlobalHandle WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW WriteFile GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW MultiByteToWideChar HeapFree GetProcessHeap HeapAlloc GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetVersionExW CreateThread GetSystemWindowsDirectoryW GetFileAttributesW GetTickCount ExitProcess Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetSystemDirectoryW GetModuleFileNameW lstrcmpW GetTempPathW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW PtInRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersAddresses

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape RectVisible GetDeviceCaps TextOutW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

157KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

241KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

IHHYNNN

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_81b51bbcd6742492007812d5514eda6a_elex_rhadamanthys_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic