Extracted

• • Target
    2026-11-09_67a81b8d0ca897a15e4237b493888bd8_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 694KB
  • SHA256 946649a9dd75f9517a679f3da296000fca9eecba6b7ada3e0f506b4e66e5c0df
  • MD5 67a81b8d0ca897a15e4237b493888bd8
  • SHA1 8609cf71f7d3372ee67db6b49d21c611fe8a2793
  • SHA512 3a21ffc680d5a8ce5d39d036731cefc12f59a021c8ce884c4aadbe95b49e36980fc0e0585f86a173a4a06933aec32b69d8a12bfe116aa5c5d85494dea60f6221
  • SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nri:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnri
  • TLSH
    T1CEE4F1216180C038F3AA077689A2E1E51A297D785790E58FF7E87DB65A311D79B3330F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionurelastrojan

  • Family: Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Custom signature

    Detects executables built or packed with MPress PE compressor

  • Custom signature

    Detects executables packed with ASPack

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2