2026-05-22_407a3076f5317ab0025cf1d8e2e379c5_bkransomware_elex_maze_rhadamanthys_smoke-loader

General

Target
2026-05-22_407a3076f5317ab0025cf1d8e2e379c5_bkransomware_elex_maze_rhadamanthys_smoke-loader
Size 494KB
Sample260522-ltppvsbt6t
SHA256 40aeea6f7e928d31d6d3d56fb92447e28b3a5aad9d39f16300efea0d4ab711b4
MD5 407a3076f5317ab0025cf1d8e2e379c5
SHA1 c2b418cff3e95a737cf5987c21d2020434d35180
SHA512 51ed6e1b70287bf36a86af34cb63f9d9cd56f2aea65b8e00b2b570a9d2c8a01cf3c9e95ff189df49b9b4a08363999fc9032795f6655ebce5ef75a79d0af850de
SSDEEP 6144:CER/W0GO69ER/W0RO6nL7tDggp2CTWus5E+QAl81+n:ztGJCtRJnpggwGHsWmn
TLSH
T1C8B48D01B9D99030E5B742775968A55206BEFD3A4F329E9F27D8098C8BB41D0BB35B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_407a3076f5317ab0025cf1d8e2e379c5_bkransomware_elex_maze_rhadamanthys_smoke-loader

File Explorer

2026-05-22_407a3076f5317ab0025cf1d8e2e379c5_bkransomware_elex_maze_rhadamanthys_smoke-loader

.exe 494KB

2026-05-22_407a3076f5317ab0025cf1d8e2e379c5_bkransomware_elex_maze_rhadamanthys_smoke-loader

IMPHASH 9b714c30ca18cf9de685e66d233930c0
SHA256 40aeea6f7e928d31d6d3d56fb92447e28b3a5aad9d39f16300efea0d4ab711b4
MD5 407a3076f5317ab0025cf1d8e2e379c5
SHA1 c2b418cff3e95a737cf5987c21d2020434d35180
SHA512 51ed6e1b70287bf36a86af34cb63f9d9cd56f2aea65b8e00b2b570a9d2c8a01cf3c9e95ff189df49b9b4a08363999fc9032795f6655ebce5ef75a79d0af850de
SSDEEP 6144:CER/W0GO69ER/W0RO6nL7tDggp2CTWus5E+QAl81+n:ztGJCtRJnpggwGHsWmn
TLSH
T1C8B48D01B9D99030E5B742775968A55206BEFD3A4F329E9F27D8098C8BB41D0BB35B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ashley\exe\release\plusstub.pdb

kernel32

GetLastError GlobalFree LockResource GlobalHandle GetModuleFileNameA CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP GetStdHandle GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc HeapSize RtlUnwind OutputDebugStringW GlobalUnlock IsDBCSLeadByte CreateProcessA GetExitCodeProcess GlobalAlloc SizeofResource SleepEx GlobalLock LoadResource FreeResource FlushFileBuffers FindResourceA HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte WriteFile GetModuleFileNameW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection FatalAppExitA HeapFree SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo CreateFileW

user32

EndPaint PostQuitMessage LoadStringA WaitForInputIdle wsprintfA GetClientRect BeginPaint MessageBoxA CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow ShowWindow DispatchMessageA SetWindowTextA UpdateWindow LoadCursorA RegisterClassA

gdi32

RealizePalette StretchDIBits SelectPalette SetStretchBltMode CreatePalette

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_407a3076f5317ab0025cf1d8e2e379c5_bkransomware_elex_maze_rhadamanthys_smoke-loader

kernel32

user32

gdi32

advapi32

generic