General
- Target 2026-11-09_24aeed1ce856dea890be04c9c61f86f9_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- Sample261111-bafbzac19j
- SHA256 d3cfce09c46b809c092260b9f0f50d61067d9b5ca1cddcecdc6c7c715c48fec8
- MD5 24aeed1ce856dea890be04c9c61f86f9
- SHA1 625bfad07a1b2a07409c347d4dadfa4dadc61d15
- SHA512 be50b3e29dd49652ed2da2fa8d775481490f0d9e5e169c7c2dba97f7229811d2ee2e846339263c86506f0a95013d6bcb3fd4fcd2cc1f36ffef6b617b7028f3e8
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nO:+rt4/NArwjs5pAV4
- TLSH T188551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-11-09_24aeed1ce856dea890be04c9c61f86f9_elex_glassworm_rhadamanthys_stealc_stop.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.226
-
218.54.31.165
Targets
-
- Target 2026-11-09_24aeed1ce856dea890be04c9c61f86f9_elex_glassworm_rhadamanthys_stealc_stop
- Size 1.3MB
- SHA256 d3cfce09c46b809c092260b9f0f50d61067d9b5ca1cddcecdc6c7c715c48fec8
- MD5 24aeed1ce856dea890be04c9c61f86f9
- SHA1 625bfad07a1b2a07409c347d4dadfa4dadc61d15
- SHA512 be50b3e29dd49652ed2da2fa8d775481490f0d9e5e169c7c2dba97f7229811d2ee2e846339263c86506f0a95013d6bcb3fd4fcd2cc1f36ffef6b617b7028f3e8
- SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nO:+rt4/NArwjs5pAV4
- TLSH T188551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE