General
- Target 2026-10-22_25747337e7fa908d4604c9144863ce41_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- Sample261024-xhs4pabx51
- SHA256 b8f7a2f0c463d19f6aa7cacb13a9e2d2778bce97267e0861963e710d45126956
- MD5 25747337e7fa908d4604c9144863ce41
- SHA1 a541437451d5338dd7f21fd17af67f652c6411b8
- SHA512 f9be7adfc1f19133cd440fa4b896eb6f79f2d5b53686f9db0950c5cae6dd70bd9a0ba43b3e74cc52e257e8497740b55ed3d541fc87a6767f87a9961d9b75ac6d
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nw:+rt4/NArwjs5pAVy
- TLSH T1DB551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-22_25747337e7fa908d4604c9144863ce41_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-10-22_25747337e7fa908d4604c9144863ce41_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- SHA256 b8f7a2f0c463d19f6aa7cacb13a9e2d2778bce97267e0861963e710d45126956
- MD5 25747337e7fa908d4604c9144863ce41
- SHA1 a541437451d5338dd7f21fd17af67f652c6411b8
- SHA512 f9be7adfc1f19133cd440fa4b896eb6f79f2d5b53686f9db0950c5cae6dd70bd9a0ba43b3e74cc52e257e8497740b55ed3d541fc87a6767f87a9961d9b75ac6d
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nw:+rt4/NArwjs5pAVy
- TLSH T1DB551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE