General
- Target 2026-06-30_8cc6739f2a6203d6d627a6267f57039e_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- Sample260701-egfsvsfy3s
- SHA256 5eb3b92bbae23b32aff69c50de6bb93c9ca34b724f1aab642598e16c588ba92e
- MD5 8cc6739f2a6203d6d627a6267f57039e
- SHA1 2d77c35396c65424424a03fa1df3da8bdf9e4a35
- SHA512 97c6ae29d154049a377e59c1d5da3632f66a132a001a79e2a71c5f6c05a663c406382c3a7ce07e0f67e54ef257c94e2e5305d64095e67e78709658fc5f9d822a
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFa:NMvrRb/G8+Ha
- TLSH T15C168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-30_8cc6739f2a6203d6d627a6267f57039e_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-06-30_8cc6739f2a6203d6d627a6267f57039e_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- SHA256 5eb3b92bbae23b32aff69c50de6bb93c9ca34b724f1aab642598e16c588ba92e
- MD5 8cc6739f2a6203d6d627a6267f57039e
- SHA1 2d77c35396c65424424a03fa1df3da8bdf9e4a35
- SHA512 97c6ae29d154049a377e59c1d5da3632f66a132a001a79e2a71c5f6c05a663c406382c3a7ce07e0f67e54ef257c94e2e5305d64095e67e78709658fc5f9d822a
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFa:NMvrRb/G8+Ha
- TLSH T15C168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE