2026-07-09_b61fc27a2bcfffbae3a2cba87144c2c1_bkransomware_elex_maze_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_b61fc27a2bcfffbae3a2cba87144c2c1_bkransomware_elex_maze_rhadamanthys
Size 1.4MB
Sample260709-3dxtzaby7y
SHA256 2eb65ca67411785889d52824dc7f51ad25a2134ec492eacc95424e0b2593164e
MD5 b61fc27a2bcfffbae3a2cba87144c2c1
SHA1 a31d5502c696bc26631bb20b7672a3988b6f5517
SHA512 ca245881042d2f6b20d523c6765bfaffde05684ea40c7c07176e99144d6404059fce94b30a1373d1683a845637d3fa9e46b6b4b2347f583a57b7c4fd9d11b98e
SSDEEP 12288:ye7yjBeA+V7YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW7:ye74YknQ/tbw/2Mkjy6Fr7g0oW7
TLSH
T1346501213685D0B2E9B302B519F4D775263EBD728FA696CFB3C80B1D5A342C06B35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_b61fc27a2bcfffbae3a2cba87144c2c1_bkransomware_elex_maze_rhadamanthys

File Explorer

2026-07-09_b61fc27a2bcfffbae3a2cba87144c2c1_bkransomware_elex_maze_rhadamanthys

.exe 1.4MB

2026-07-09_b61fc27a2bcfffbae3a2cba87144c2c1_bkransomware_elex_maze_rhadamanthys

IMPHASH 4aed089ac3b5b4582f4fe0e99626a005
SHA256 2eb65ca67411785889d52824dc7f51ad25a2134ec492eacc95424e0b2593164e
MD5 b61fc27a2bcfffbae3a2cba87144c2c1
SHA1 a31d5502c696bc26631bb20b7672a3988b6f5517
SHA512 ca245881042d2f6b20d523c6765bfaffde05684ea40c7c07176e99144d6404059fce94b30a1373d1683a845637d3fa9e46b6b4b2347f583a57b7c4fd9d11b98e
SSDEEP 12288:ye7yjBeA+V7YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW7:ye74YknQ/tbw/2Mkjy6Fr7g0oW7
TLSH
T1346501213685D0B2E9B302B519F4D775263EBD728FA696CFB3C80B1D5A342C06B35B52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\BkavHomeUpdateService\BkavHome\Release\BkavHomeUpdateService.pdb

advapi32

RegCreateKeyExW RegCloseKey RegQueryValueExW RegSetValueExW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW CreateServiceW CloseServiceHandle OpenServiceW ControlService QueryServiceStatus DeleteService OpenProcessToken CreateProcessAsUserW

user32

EnumWindows GetClassNameW GetWindowTextW GetWindowThreadProcessId SendMessageW LoadStringW

kernel32

SetEndOfFile WriteConsoleW SetStdHandle ReadConsoleW LCMapStringW EnumSystemLocalesW GetUserDefaultLCID OutputDebugStringW GetLocalTime GetLastError SetLastError FormatMessageW LocalFree GetModuleHandleW WideCharToMultiByte MultiByteToWideChar ReadFile WriteFile CreateFileW GetFileSize SetFilePointer CloseHandle ExpandEnvironmentStringsW CreateDirectoryW GetModuleFileNameW Sleep lstrlenW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW GetSystemDirectoryW LoadLibraryW GetProcAddress DeleteFileW MoveFileW FindFirstFileW DecodePointer SetEvent WaitForSingleObject FreeLibrary HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateEventW WaitForMultipleObjects TerminateProcess GetExitCodeProcess CopyFileW MoveFileExW FindNextFileW FindClose QueueUserWorkItem CreateToolhelp32Snapshot Process32FirstW ProcessIdToSessionId Process32NextW OpenProcess GetCurrentProcessId GetCurrentProcess IsDebuggerPresent IsProcessorFeaturePresent EncodePointer GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection GetCommandLineW ExitProcess GetModuleHandleExW GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetFileType GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW RtlUnwind GetStringTypeW GetLocaleInfoW IsValidLocale

shlwapi

PathFindExtensionW PathFileExistsW PathRemoveFileSpecW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_b61fc27a2bcfffbae3a2cba87144c2c1_bkransomware_elex_maze_rhadamanthys

advapi32

user32

kernel32

shlwapi

wtsapi32

userenv

generic