General
- Target 2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- Sample260718-1ffblags4v
- SHA256 fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894
- MD5 a405440bb8cbde599b7b39b25d2c9087
- SHA1 f2b504f081ff33ab2111d82f792352c938b18caa
- SHA512 fbc9586d4453f6b5e376f303a0fe848e85043800b2eb7b66384bcd48a9626e6b2c264f39cbc96002ad3c8e50b12448d4fce46dfaeafe2dfdb4457d91dceae834
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFb:NMvrRb/G8+Hb
- TLSH T19D168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- SHA256 fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894
- MD5 a405440bb8cbde599b7b39b25d2c9087
- SHA1 f2b504f081ff33ab2111d82f792352c938b18caa
- SHA512 fbc9586d4453f6b5e376f303a0fe848e85043800b2eb7b66384bcd48a9626e6b2c264f39cbc96002ad3c8e50b12448d4fce46dfaeafe2dfdb4457d91dceae834
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFb:NMvrRb/G8+Hb
- TLSH T19D168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE