2026-07-20_e0d9fb79ebe95952fa9823911119a4f2_bkransomware_elex_maze_rhadamanthys

General

Target
2026-07-20_e0d9fb79ebe95952fa9823911119a4f2_bkransomware_elex_maze_rhadamanthys
Size 3.2MB
Sample260720-vcpg7sat71
SHA256 d1c3aaa83366f0b32ef442413993dbb611721079bb8a12d9b1990bd92fa5a0f8
MD5 e0d9fb79ebe95952fa9823911119a4f2
SHA1 9898b8bf132edbfdd70a0f0e2e5e1d28b3d37ab5
SHA512 35135105a8f9f76640573ff971b148ee0f06fe78c2dc4571620b7ac54a768ded0560500892f0e033f94c04a86c30895c629c74c6b2fa23731fb29e80fa54c475
SSDEEP 49152:D6fXxcxlTZP7x6e7im2kLXT25Xr+1ggb2KAbm80+3pe4bIYGjj53QcWKADIaX6AE:D6ZcntPmcTKXIM13pe4Mpjj5gc2DljgT
TLSH
T178F5330337F852F0F43959771A70E58147AFFA196AF89E17A7DC11602CA64E3C8897A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_e0d9fb79ebe95952fa9823911119a4f2_bkransomware_elex_maze_rhadamanthys

File Explorer

2026-07-20_e0d9fb79ebe95952fa9823911119a4f2_bkransomware_elex_maze_rhadamanthys

.exe 3.2MB

2026-07-20_e0d9fb79ebe95952fa9823911119a4f2_bkransomware_elex_maze_rhadamanthys

IMPHASH 46ad3d954e527f769e37017b3e128039
SHA256 d1c3aaa83366f0b32ef442413993dbb611721079bb8a12d9b1990bd92fa5a0f8
MD5 e0d9fb79ebe95952fa9823911119a4f2
SHA1 9898b8bf132edbfdd70a0f0e2e5e1d28b3d37ab5
SHA512 35135105a8f9f76640573ff971b148ee0f06fe78c2dc4571620b7ac54a768ded0560500892f0e033f94c04a86c30895c629c74c6b2fa23731fb29e80fa54c475
SSDEEP 49152:D6fXxcxlTZP7x6e7im2kLXT25Xr+1ggb2KAbm80+3pe4bIYGjj53QcWKADIaX6AE:D6ZcntPmcTKXIM13pe4Mpjj5gc2DljgT
TLSH
T178F5330337F852F0F43959771A70E58147AFFA196AF89E17A7DC11602CA64E3C8897A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile ReadFile CreateFileW FlushFileBuffers GetLastError FindClose LocalAlloc GetLogicalDriveStringsW LocalFree CreateThread ExpandEnvironmentStringsW WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode CreateProcessW SetFilePointer GetDriveTypeW FindFirstFileW CreateMutexW GetFileSize GetEnvironmentVariableW FindNextFileW ExitProcess GetConsoleCP GetCommandLineW IsProcessorFeaturePresent SetLastError GetCurrentThreadId EncodePointer DecodePointer GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo IsDebuggerPresent LoadLibraryExW RtlUnwind OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW CloseHandle

user32

wsprintfW

advapi32

RegCloseKey CryptGenRandom RegCreateKeyW CryptAcquireContextW RegSetValueExW

ntdll

RtlAdjustPrivilege NtDelayExecution NtClose

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_e0d9fb79ebe95952fa9823911119a4f2_bkransomware_elex_maze_rhadamanthys

kernel32

user32

advapi32

ntdll

generic