General
- Target 2026-08-01_b38366fc790079cab744421396e47fea_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- Sample260801-fgbdtav1ev
- SHA256 41eade74a99c7768b6efddd5d571023d5d2d4068843157eb846aab4bce72ce3e
- MD5 b38366fc790079cab744421396e47fea
- SHA1 05da971e1666fd849b8301f16853519386eae626
- SHA512 8c9e882d6b5af016a55397970367d67911a2d674b1885d49e71fa9af0f170d91bdf4849f2aa3bf315a196382878b3efe81e46001939c7de5a16809055485604c
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFS:NMvrRb/G8+HS
- TLSH T125168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-01_b38366fc790079cab744421396e47fea_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-08-01_b38366fc790079cab744421396e47fea_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- SHA256 41eade74a99c7768b6efddd5d571023d5d2d4068843157eb846aab4bce72ce3e
- MD5 b38366fc790079cab744421396e47fea
- SHA1 05da971e1666fd849b8301f16853519386eae626
- SHA512 8c9e882d6b5af016a55397970367d67911a2d674b1885d49e71fa9af0f170d91bdf4849f2aa3bf315a196382878b3efe81e46001939c7de5a16809055485604c
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFS:NMvrRb/G8+HS
- TLSH T125168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE