General
- Target 2026-10-28_6518c2f28f88dba6313b4dbba710cff6_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- Sample261028-m2967sct3j
- SHA256 054885ef01c48f0613ec593dadaf4766d0fc8b16d1dfc17fcbe86ce591d93db6
- MD5 6518c2f28f88dba6313b4dbba710cff6
- SHA1 1083d7b818ba9fcceb31afe78547087f036187b7
- SHA512 2cfaad86bd31b0102d231b7ce9e3ed9fd9fc3b03cd092ea1d7f4d792609415c4a15f31a2a2b757b85085087189a9c1efe8ce11412176fb0e54826289e2fa45ec
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nI:+rt4/NArwjs5pAVu
- TLSH T192551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_6518c2f28f88dba6313b4dbba710cff6_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-10-28_6518c2f28f88dba6313b4dbba710cff6_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- SHA256 054885ef01c48f0613ec593dadaf4766d0fc8b16d1dfc17fcbe86ce591d93db6
- MD5 6518c2f28f88dba6313b4dbba710cff6
- SHA1 1083d7b818ba9fcceb31afe78547087f036187b7
- SHA512 2cfaad86bd31b0102d231b7ce9e3ed9fd9fc3b03cd092ea1d7f4d792609415c4a15f31a2a2b757b85085087189a9c1efe8ce11412176fb0e54826289e2fa45ec
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nI:+rt4/NArwjs5pAVu
- TLSH T192551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE