General
- Target 2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- Sample260804-d3fvbavvbx
- SHA256 7613bfef948c10cb41f3cdb093989f10879582090c7921676254282a2970c7f6
- MD5 0a11d21a08214450a2372b8b6c4e5b27
- SHA1 4ce1b6e96c048f5a3e5f9f3b88d50b02d931027d
- SHA512 f892a43129f1a9265784b627df7b08ead975100d7eb294ca85cdafa1c5b9313c67262c7aa6fe7c1da02811c52efafd75542248ce6beab88aee4a6076f40bfb68
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtF/:NMvrRb/G8+H/
- TLSH T156168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop
- Size 3.9MB
- SHA256 7613bfef948c10cb41f3cdb093989f10879582090c7921676254282a2970c7f6
- MD5 0a11d21a08214450a2372b8b6c4e5b27
- SHA1 4ce1b6e96c048f5a3e5f9f3b88d50b02d931027d
- SHA512 f892a43129f1a9265784b627df7b08ead975100d7eb294ca85cdafa1c5b9313c67262c7aa6fe7c1da02811c52efafd75542248ce6beab88aee4a6076f40bfb68
- SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtF/:NMvrRb/G8+H/
- TLSH T156168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE