General
- Target 2026-10-28_0e429defe7f0b4bcea4fbf8be44ed7a6_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- Sample261028-sdggwagf56
- SHA256 66d01bf5091913847c02bcc423c6fe256fbee3ea3829d8f1f55064a00717a044
- MD5 0e429defe7f0b4bcea4fbf8be44ed7a6
- SHA1 7fd6625b06d7e46c31cbb6414477884bce664791
- SHA512 fa0a59d82f4e3814f3110d1fffcf03d6ba8774dcf5e881bb255c7b6be8c736df611b3f800fd9fcf6a0225d161cf20ddd2eea469717183938638bec92679acc32
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nZ:+rt4/NArwjs5pAV/
- TLSH T1C1551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-28_0e429defe7f0b4bcea4fbf8be44ed7a6_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-10-28_0e429defe7f0b4bcea4fbf8be44ed7a6_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- SHA256 66d01bf5091913847c02bcc423c6fe256fbee3ea3829d8f1f55064a00717a044
- MD5 0e429defe7f0b4bcea4fbf8be44ed7a6
- SHA1 7fd6625b06d7e46c31cbb6414477884bce664791
- SHA512 fa0a59d82f4e3814f3110d1fffcf03d6ba8774dcf5e881bb255c7b6be8c736df611b3f800fd9fcf6a0225d161cf20ddd2eea469717183938638bec92679acc32
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nZ:+rt4/NArwjs5pAV/
- TLSH T1C1551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE