urelas | 2026-11-09_1c342c4430db1ac0a815be37324067a7_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_1c342c4430db1ac0a815be37324067a7_elex_rhadamanthys_stop
Size 464KB
Sample261111-ccq2xsds8p
SHA256 c1b8d5365645a781f60ffb05f07b7ce2e1eff719b3c72ec0e7efb20c13fe4766
MD5 1c342c4430db1ac0a815be37324067a7
SHA1 405014338d61ba90bab9c24678a6fe76cee098ad
SHA512 7df62b7c59e9ea429d05bbbe0b9ad8cfb7f4ad1d8ff8ef66e179d9ac6dded17cb683f7887e9f1cffd3b0d58c23d5e7edca1725fbb7481b74e9e6202378b4fb11
SSDEEP 6144:P8Eoe/IebBVMweZGhHdJBV70FVKLbfW2x8VyMsmD6gzOmjpi+pMJQ8uUm9unpmE:vDdUGhHdJ370FVKmP0Ml+gzzjp+lsuN
TLSH
T12AA4C0153680C472E36627314996E2F11AAABC3959A4E68FF7A43F396D311C3873724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan urelas

Malware Config

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_1c342c4430db1ac0a815be37324067a7_elex_rhadamanthys_stop

File Explorer

2026-11-09_1c342c4430db1ac0a815be37324067a7_elex_rhadamanthys_stop

.exe 464KB

2026-11-09_1c342c4430db1ac0a815be37324067a7_elex_rhadamanthys_stop

IMPHASH 0ed9bb83b46883e5a2e5037acb0b0efe
SHA256 c1b8d5365645a781f60ffb05f07b7ce2e1eff719b3c72ec0e7efb20c13fe4766
MD5 1c342c4430db1ac0a815be37324067a7
SHA1 405014338d61ba90bab9c24678a6fe76cee098ad
SHA512 7df62b7c59e9ea429d05bbbe0b9ad8cfb7f4ad1d8ff8ef66e179d9ac6dded17cb683f7887e9f1cffd3b0d58c23d5e7edca1725fbb7481b74e9e6202378b4fb11
SSDEEP 6144:P8Eoe/IebBVMweZGhHdJBV70FVKLbfW2x8VyMsmD6gzOmjpi+pMJQ8uUm9unpmE:vDdUGhHdJ370FVKmP0Ml+gzzjp+lsuN
TLSH
T12AA4C0153680C472E36627314996E2F11AAABC3959A4E68FF7A43F396D311C3873724F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20131216)\GolfUpdate\bin\GolfUpdate.pdb

kernel32

TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA GlobalUnlock LoadLibraryA LoadLibraryW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA InitializeCriticalSection GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError GlobalAlloc GlobalHandle WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW WriteFile GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW MultiByteToWideChar HeapFree GetProcessHeap HeapAlloc GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetVersionExW CreateThread GetSystemWindowsDirectoryW GetFileAttributesW GetTickCount ExitProcess Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetSystemDirectoryW GetModuleFileNameW lstrcmpW GetTempPathW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW PtInRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersAddresses

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape RectVisible GetDeviceCaps TextOutW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

157KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

241KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

IHHYNNN

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_1c342c4430db1ac0a815be37324067a7_elex_rhadamanthys_stop

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic