General
- Target 2026-07-22_8c8fa71722e12444d9b368b79d5b3363_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- Sample260722-s3j93ack7w
- SHA256 dc1b4a584ac9a6789fc1307d59e6657f4b762e93928d55739bdf63cc0766a8f7
- MD5 8c8fa71722e12444d9b368b79d5b3363
- SHA1 cdae4ac794f84a75d449c48e12c12b9d9cefdb63
- SHA512 b6df5e3b40c443a199fd84da89835202230ef18e2745b6c33f4430eef946e1c48b5b1d8c0fe2973a37f136f4dc206eef29808bf495590f0dc40be415d3cbe302
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFX:NMvrRb/G8+HX
- TLSH T1D2168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-22_8c8fa71722e12444d9b368b79d5b3363_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-07-22_8c8fa71722e12444d9b368b79d5b3363_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- SHA256 dc1b4a584ac9a6789fc1307d59e6657f4b762e93928d55739bdf63cc0766a8f7
- MD5 8c8fa71722e12444d9b368b79d5b3363
- SHA1 cdae4ac794f84a75d449c48e12c12b9d9cefdb63
- SHA512 b6df5e3b40c443a199fd84da89835202230ef18e2745b6c33f4430eef946e1c48b5b1d8c0fe2973a37f136f4dc206eef29808bf495590f0dc40be415d3cbe302
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFX:NMvrRb/G8+HX
- TLSH T1D2168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE