2026-07-03_a6d2f16971e02d3c67a2d045c23238ab_bkransomware_elex_maze_rhadamanthys_smoke-loader

General

Target
2026-07-03_a6d2f16971e02d3c67a2d045c23238ab_bkransomware_elex_maze_rhadamanthys_smoke-loader
Size 516KB
Sample260703-lxs7fsey7t
SHA256 268c70f221c8de1c7d73eb4e1ad6cba49313d8982adc1c1148e8973ef27572c6
MD5 a6d2f16971e02d3c67a2d045c23238ab
SHA1 f85caf8447a8d577edef70ee091e7cf4414b1a9b
SHA512 06a56b2738d83675332dfafb7a4bdc3e8836ca97e3559f4c6038c65f29f56b8534a6fec3d9cddb4838ea1986125b2f0a4c8870a102553a7b0bae3fa144e6da78
SSDEEP 6144:CER/W0pO6NER/W0RO6lO6JER/W0G9/BO4Ha8R2U9NHBcBTvkxQM:ztpJStRJlJGtuUcRcU9NEbK
TLSH
T18AB47D01B8D98030E5B742774964A95206BEFD7A4F369E9F27D80D8C9B741C0BB26B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_a6d2f16971e02d3c67a2d045c23238ab_bkransomware_elex_maze_rhadamanthys_smoke-loader

File Explorer

2026-07-03_a6d2f16971e02d3c67a2d045c23238ab_bkransomware_elex_maze_rhadamanthys_smoke-loader

.exe 516KB

2026-07-03_a6d2f16971e02d3c67a2d045c23238ab_bkransomware_elex_maze_rhadamanthys_smoke-loader

IMPHASH 9b714c30ca18cf9de685e66d233930c0
SHA256 268c70f221c8de1c7d73eb4e1ad6cba49313d8982adc1c1148e8973ef27572c6
MD5 a6d2f16971e02d3c67a2d045c23238ab
SHA1 f85caf8447a8d577edef70ee091e7cf4414b1a9b
SHA512 06a56b2738d83675332dfafb7a4bdc3e8836ca97e3559f4c6038c65f29f56b8534a6fec3d9cddb4838ea1986125b2f0a4c8870a102553a7b0bae3fa144e6da78
SSDEEP 6144:CER/W0pO6NER/W0RO6lO6JER/W0G9/BO4Ha8R2U9NHBcBTvkxQM:ztpJStRJlJGtuUcRcU9NEbK
TLSH
T18AB47D01B8D98030E5B742774964A95206BEFD7A4F369E9F27D80D8C9B741C0BB26B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ashley\exe\release\plusstub.pdb

kernel32

GetLastError GlobalFree LockResource GlobalHandle GetModuleFileNameA CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP GetStdHandle GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc HeapSize RtlUnwind OutputDebugStringW GlobalUnlock IsDBCSLeadByte CreateProcessA GetExitCodeProcess GlobalAlloc SizeofResource SleepEx GlobalLock LoadResource FreeResource FlushFileBuffers FindResourceA HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte WriteFile GetModuleFileNameW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection FatalAppExitA HeapFree SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo CreateFileW

user32

EndPaint PostQuitMessage LoadStringA WaitForInputIdle wsprintfA GetClientRect BeginPaint MessageBoxA CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow ShowWindow DispatchMessageA SetWindowTextA UpdateWindow LoadCursorA RegisterClassA

gdi32

RealizePalette StretchDIBits SelectPalette SetStretchBltMode CreatePalette

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_a6d2f16971e02d3c67a2d045c23238ab_bkransomware_elex_maze_rhadamanthys_smoke-loader

kernel32

user32

gdi32

advapi32

generic