General
- Target 2026-06-03_dded96671d8ed61da33567ffd3067df6_elex_glassworm_njrat_rhadamanthys_stealc_stop
- Size 2.5MB
- Sample260603-2g2fwsf15l
- SHA256 e563e7ab3405853ad69fb6951c8ad40f37974a379bf47e9ec6ecb596f097e503
- MD5 dded96671d8ed61da33567ffd3067df6
- SHA1 a1d5e8630c9affc365f9db2c6e4b03d0e35d0e4b
- SHA512 ed9b2fdb9461d72da141cdbdaccc49287061e5538d118388ce4da89ac625d74995e3768df72ad55c7dec533bffae7a60a90bec9e24d1dda2479dbea082a49520
- SSDEEP 24576:20P/k4lb2wKat0AVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHp5HZxFq9uw:Nk4pVmgbQIzZMPXpB91rHpnw
- TLSH T1F3C54A53EB4149E9E38D05369F448150D72AF92997EF1361742C620CDEA3387BF62A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-03_dded96671d8ed61da33567ffd3067df6_elex_glassworm_njrat_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-06-03_dded96671d8ed61da33567ffd3067df6_elex_glassworm_njrat_rhadamanthys_stealc_stop
- Size 2.5MB
- SHA256 e563e7ab3405853ad69fb6951c8ad40f37974a379bf47e9ec6ecb596f097e503
- MD5 dded96671d8ed61da33567ffd3067df6
- SHA1 a1d5e8630c9affc365f9db2c6e4b03d0e35d0e4b
- SHA512 ed9b2fdb9461d72da141cdbdaccc49287061e5538d118388ce4da89ac625d74995e3768df72ad55c7dec533bffae7a60a90bec9e24d1dda2479dbea082a49520
- SSDEEP 24576:20P/k4lb2wKat0AVDKUTbQIzFLwLIM0iwg99Vpibu9QcrHp5HZxFq9uw:Nk4pVmgbQIzZMPXpB91rHpnw
- TLSH T1F3C54A53EB4149E9E38D05369F448150D72AF92997EF1361742C620CDEA3387BF62A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE