urelas | 2026-11-09_75f0df3b1a32e9fb97b7c9fb2b2c4943_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_75f0df3b1a32e9fb97b7c9fb2b2c4943_elex_rhadamanthys_stop
Size 464KB
Sample261110-s8vb8age45
SHA256 ea9c519635d7cc4c0421cc619e4759948d240df90e3bb7902cbcf6bc277ff135
MD5 75f0df3b1a32e9fb97b7c9fb2b2c4943
SHA1 a77882af2963574bc4b6f38fef5adf45aa79329b
SHA512 9cb97b14bb53bf94b79c6446b932c9b25b79507317dd5fd26098530c6d6bb67d26c84acec2e277ef898575e8a98baec028e8ba37aac3d1fc3e3e7e1202f42df5
SSDEEP 6144:P8Eoe/IebBVMweZGhHdJBV70FVKLbfW2x8VyMsmD6gzOmjpi+pMJQ8uUm9unpm+:vDdUGhHdJ370FVKmP0Ml+gzzjp+lsu/
TLSH
T1B3A4C0153680C472E36627314996E2F11AAABC3959A4E68FF7A43E396D311C3873724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_75f0df3b1a32e9fb97b7c9fb2b2c4943_elex_rhadamanthys_stop

File Explorer

2026-11-09_75f0df3b1a32e9fb97b7c9fb2b2c4943_elex_rhadamanthys_stop

.exe 464KB

2026-11-09_75f0df3b1a32e9fb97b7c9fb2b2c4943_elex_rhadamanthys_stop

IMPHASH 0ed9bb83b46883e5a2e5037acb0b0efe
SHA256 ea9c519635d7cc4c0421cc619e4759948d240df90e3bb7902cbcf6bc277ff135
MD5 75f0df3b1a32e9fb97b7c9fb2b2c4943
SHA1 a77882af2963574bc4b6f38fef5adf45aa79329b
SHA512 9cb97b14bb53bf94b79c6446b932c9b25b79507317dd5fd26098530c6d6bb67d26c84acec2e277ef898575e8a98baec028e8ba37aac3d1fc3e3e7e1202f42df5
SSDEEP 6144:P8Eoe/IebBVMweZGhHdJBV70FVKLbfW2x8VyMsmD6gzOmjpi+pMJQ8uUm9unpm+:vDdUGhHdJ370FVKmP0Ml+gzzjp+lsu/
TLSH
T1B3A4C0153680C472E36627314996E2F11AAABC3959A4E68FF7A43E396D311C3873724F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20131216)\GolfUpdate\bin\GolfUpdate.pdb

kernel32

TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA GlobalUnlock LoadLibraryA LoadLibraryW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA InitializeCriticalSection GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError GlobalAlloc GlobalHandle WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW WriteFile GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW MultiByteToWideChar HeapFree GetProcessHeap HeapAlloc GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetVersionExW CreateThread GetSystemWindowsDirectoryW GetFileAttributesW GetTickCount ExitProcess Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetSystemDirectoryW GetModuleFileNameW lstrcmpW GetTempPathW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW PtInRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersAddresses

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape RectVisible GetDeviceCaps TextOutW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

157KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

241KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

IHHYNNN

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_75f0df3b1a32e9fb97b7c9fb2b2c4943_elex_rhadamanthys_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic