2026-06-01_066323f1e411a3d785eca57321c4158e_bkransomware_elex_maze_rhadamanthys_smoke-loader

General

Target
2026-06-01_066323f1e411a3d785eca57321c4158e_bkransomware_elex_maze_rhadamanthys_smoke-loader
Size 563KB
Sample260601-lc8fmsas2l
SHA256 c0f2f3a4783cac855dc4175ceabbba43e5ee7f38f6c339fd61133a57245bb174
MD5 066323f1e411a3d785eca57321c4158e
SHA1 4d00a0f73915359e2bc01664c016bb30d2aeeb37
SHA512 b164c48d11d14e13712835e0f09448ee924b83759b376adb3520190253fe8a3a3dbd65985c130959945f1cac547f53ccdd07ac5db7290ce6945873431eca8fff
SSDEEP 6144:CER/W0jO6RER/W0RO6wMZ5+B5GXMKZEMm+sr:ztjJOtRJwM8GXlud
TLSH
T197C48D01B9D99030E5B742771964E65207BEFD3A8F329E9F2BD8088D5B781D0A725B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-01_066323f1e411a3d785eca57321c4158e_bkransomware_elex_maze_rhadamanthys_smoke-loader

File Explorer

2026-06-01_066323f1e411a3d785eca57321c4158e_bkransomware_elex_maze_rhadamanthys_smoke-loader

.exe 563KB

2026-06-01_066323f1e411a3d785eca57321c4158e_bkransomware_elex_maze_rhadamanthys_smoke-loader

IMPHASH 9b714c30ca18cf9de685e66d233930c0
SHA256 c0f2f3a4783cac855dc4175ceabbba43e5ee7f38f6c339fd61133a57245bb174
MD5 066323f1e411a3d785eca57321c4158e
SHA1 4d00a0f73915359e2bc01664c016bb30d2aeeb37
SHA512 b164c48d11d14e13712835e0f09448ee924b83759b376adb3520190253fe8a3a3dbd65985c130959945f1cac547f53ccdd07ac5db7290ce6945873431eca8fff
SSDEEP 6144:CER/W0jO6RER/W0RO6wMZ5+B5GXMKZEMm+sr:ztjJOtRJwM8GXlud
TLSH
T197C48D01B9D99030E5B742771964E65207BEFD3A8F329E9F2BD8088D5B781D0A725B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ashley\exe\release\plusstub.pdb

kernel32

GetLastError GlobalFree LockResource GlobalHandle GetModuleFileNameA CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP GetStdHandle GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc HeapSize RtlUnwind OutputDebugStringW GlobalUnlock IsDBCSLeadByte CreateProcessA GetExitCodeProcess GlobalAlloc SizeofResource SleepEx GlobalLock LoadResource FreeResource FlushFileBuffers FindResourceA HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte WriteFile GetModuleFileNameW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection FatalAppExitA HeapFree SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo CreateFileW

user32

EndPaint PostQuitMessage LoadStringA WaitForInputIdle wsprintfA GetClientRect BeginPaint MessageBoxA CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow ShowWindow DispatchMessageA SetWindowTextA UpdateWindow LoadCursorA RegisterClassA

gdi32

RealizePalette StretchDIBits SelectPalette SetStretchBltMode CreatePalette

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_066323f1e411a3d785eca57321c4158e_bkransomware_elex_maze_rhadamanthys_smoke-loader

kernel32

user32

gdi32

advapi32

generic