2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

General

Target
2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc
Size 123KB
Sample260715-splkzaft2l
SHA256 4ff064c858a356a8e8a8d3fceca218d3ee9c93f0e92cc3d11a13daf58b22dd9c
MD5 acd42a57d0eecbbd1a1253a07b48c780
SHA1 f171782905af128f2135fb1214df9905f0cdafb8
SHA512 dca9a8bc9e991ecae7165a226eb90ede4013940d9bcceaa5e6ae9dbb9b17be331bd6cefd64780b2a113c2f85daec7ab7f22b2ad61b33b8d54cb80eda4029e002
SSDEEP 1536:i0DotuWGl9OO9GjTQl5bm/ynWcp6CsWjcdNuEtA06ln+8+2eQotxrdTcxJL:vDoYp3ObQ+/y6oEtA0BQo/pTcxJL
TLSH
T1B2C35B0172D1A071D4A6753109A4BA71062EFEF67E61DF07A3E8534AC9771A01E3BB3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

.exe 123KB

2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

IMPHASH fa96ab25e78983ba40692e3537afea01
SHA256 4ff064c858a356a8e8a8d3fceca218d3ee9c93f0e92cc3d11a13daf58b22dd9c
MD5 acd42a57d0eecbbd1a1253a07b48c780
SHA1 f171782905af128f2135fb1214df9905f0cdafb8
SHA512 dca9a8bc9e991ecae7165a226eb90ede4013940d9bcceaa5e6ae9dbb9b17be331bd6cefd64780b2a113c2f85daec7ab7f22b2ad61b33b8d54cb80eda4029e002
SSDEEP 1536:i0DotuWGl9OO9GjTQl5bm/ynWcp6CsWjcdNuEtA06ln+8+2eQotxrdTcxJL:vDoYp3ObQ+/y6oEtA0BQo/pTcxJL
TLSH
T1B2C35B0172D1A071D4A6753109A4BA71062EFEF67E61DF07A3E8534AC9771A01E3BB3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

24:1c:06:28:8c:73:e1:39:b2:57:47:52:96:b9:58:b6:8c:9c:b9:ac:7a:5b:55:32:6e:17:c8:42:27:75:77:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=미래에셋대우 주식회사,OU=IT Team,O=미래에셋대우 주식회사,L=Jung-gu,ST=SEOUL,C=KR

Chains

Feb 21, 2020

CN=미래에셋대우 주식회사,OU=IT Team,O=미래에셋대우 주식회사,L=Jung-gu,ST=SEOUL,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=미래에셋대우 주식회사,OU=IT Team,O=미래에셋대우 주식회사,L=Jung-gu,ST=SEOUL,C=KR

Serial Number

32:fa:aa:dc:bb:6e:c1:33:5a:77:ab:b7:f4:0f:be:92

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 8, 2018 - Dec 7, 2020

Minor OS version

1

Major OS version

5

Entry point

11349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Jaehyun\Desktop\파워맵\파워맵프로그램\미래에셋투자\output\PowerMapRun.pdb

kernel32

GetConsoleWindow CreateProcessA GetModuleFileNameA ReadFile SetEndOfFile CreateFileW GetStringTypeW LCMapStringW HeapReAlloc HeapAlloc HeapSize OutputDebugStringW FlushFileBuffers WriteConsoleW SetStdHandle IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer GetLastError ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineA EnterCriticalSection LeaveCriticalSection RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW WriteFile GetConsoleCP GetConsoleMode CloseHandle HeapFree DeleteCriticalSection GetStdHandle GetModuleFileNameW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetProcessHeap GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx ReadConsoleW

user32

MessageBoxA ShowWindow

ws2_32

WSAStartup inet_addr select htons shutdown inet_ntoa recv socket __WSAFDIsSet closesocket gethostbyname send connect ioctlsocket WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_acd42a57d0eecbbd1a1253a07b48c780_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_stealc

kernel32

user32

ws2_32

generic