General
- Target 2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop
- Size 2.3MB
- Sample260504-mexmlact2q
- SHA256 3aae20179b12f402c20a72393b8be067fec89a8a61682c0214b1ce2034d0c2d0
- MD5 676ca5ae940f6c24a81845fa1c1279c8
- SHA1 4f26e683423e79cf9013fb3017a42103810b53b9
- SHA512 bda64290b8d550d83ed2ec71ee65ba5d3a92dd4285fc9000f32663c47e09dce241d6b1947fa47b07f3ec03a87f8bbb9c6e62f371d2d30c0003627b80832face7
- SSDEEP 24576:crt4/NArwjs5gAVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHpm/:9/NlI5TVmgbQIzZMPXpB91rHpu
- TLSH T17DB51753EB814AD9E38D0536DF448150972AF92997FF1260742822DCDEA3387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-05-04_676ca5ae940f6c24a81845fa1c1279c8_elex_glassworm_rhadamanthys_stealc_stop
- Size 2.3MB
- SHA256 3aae20179b12f402c20a72393b8be067fec89a8a61682c0214b1ce2034d0c2d0
- MD5 676ca5ae940f6c24a81845fa1c1279c8
- SHA1 4f26e683423e79cf9013fb3017a42103810b53b9
- SHA512 bda64290b8d550d83ed2ec71ee65ba5d3a92dd4285fc9000f32663c47e09dce241d6b1947fa47b07f3ec03a87f8bbb9c6e62f371d2d30c0003627b80832face7
- SSDEEP 24576:crt4/NArwjs5gAVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHpm/:9/NlI5TVmgbQIzZMPXpB91rHpu
- TLSH T17DB51753EB814AD9E38D0536DF448150972AF92997FF1260742822DCDEA3387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE