2026-08-10_54b28ee01cf48b7e5336ff21b2158299_bkransomware_elex

General

Target
2026-08-10_54b28ee01cf48b7e5336ff21b2158299_bkransomware_elex
Size 389KB
Sample260810-c31daazcld
SHA256 7af1bceb7065fbc254ec43b9b25f906c3f180f807dca63dd95a95436a44d1346
MD5 54b28ee01cf48b7e5336ff21b2158299
SHA1 73e0f596f77ffa8f91b8143c02bc15f0d6250320
SHA512 30b55e246d10f2fb4e5c3abd57f27f1862b959ab6a0c54b03c79151785d882fa88051889a6899b10de6bfd0888ee01d59c6a1b376a6da83a74702aa08ecea224
SSDEEP 3072:/hoLz6eJUJ3/rlpqy/i88U71N+4A7ABNmEQXwcr00+qXanTej3Hcif+1p/M5kCAJ:xjlsy/771NnPaqTycs+15sE
TLSH
T149848D61AB9082B6E553073688AA6F14373EBE315B3357C73794251E0DB23C4BE32B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_54b28ee01cf48b7e5336ff21b2158299_bkransomware_elex

File Explorer

2026-08-10_54b28ee01cf48b7e5336ff21b2158299_bkransomware_elex

.exe 389KB

2026-08-10_54b28ee01cf48b7e5336ff21b2158299_bkransomware_elex

IMPHASH 3b4fdda4c1ff98b952839d52cf80adfa
SHA256 7af1bceb7065fbc254ec43b9b25f906c3f180f807dca63dd95a95436a44d1346
MD5 54b28ee01cf48b7e5336ff21b2158299
SHA1 73e0f596f77ffa8f91b8143c02bc15f0d6250320
SHA512 30b55e246d10f2fb4e5c3abd57f27f1862b959ab6a0c54b03c79151785d882fa88051889a6899b10de6bfd0888ee01d59c6a1b376a6da83a74702aa08ecea224
SSDEEP 3072:/hoLz6eJUJ3/rlpqy/i88U71N+4A7ABNmEQXwcr00+qXanTej3Hcif+1p/M5kCAJ:xjlsy/771NnPaqTycs+15sE
TLSH
T149848D61AB9082B6E553073688AA6F14373EBE315B3357C73794251E0DB23C4BE32B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\build\ob\bora-17340778\vos3\thinstall\modules\boot_loader.pdb

kernel32

WaitForSingleObject Sleep CloseHandle DuplicateHandle CreateProcessW GetStartupInfoW GetEnvironmentVariableW GetCurrentProcess GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MoveFileExW SetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetLastError ExpandEnvironmentStringsW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc WriteFile LeaveCriticalSection EnterCriticalSection HeapSize VirtualQuery GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW DecodePointer EncodePointer RaiseException RtlUnwind GetCommandLineA LoadLibraryW GetProcAddress GetCurrentThreadId ExitProcess FormatMessageW SetLastError LocalFree LoadLibraryExW

user32

wsprintfW MessageBoxW

ntdll

RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlFreeSid RtlCreateAcl RtlLengthSid RtlCreateSecurityDescriptor RtlAllocateAndInitializeSid NtReadVirtualMemory NtSetInformationProcess NtRaiseHardError NtTerminateProcess RtlFreeHeap RtlAllocateHeap RtlRaiseException NtReleaseMutant NtCreateMutant NtSetEvent NtOpenEvent NtQueryVirtualMemory NtSetInformationFile NtQueryDirectoryFile NtClearEvent NtCreateEvent LdrUnloadDll NtWriteVirtualMemory NtReadFile NtQueryFullAttributesFile NtQueryInformationFile NtOpenFile NtMapViewOfSection NtCreateSection RtlMultiByteToUnicodeN LdrGetProcedureAddress RtlQueryEnvironmentVariable_U RtlCompareUnicodeString RtlInitAnsiString NtAllocateVirtualMemory RtlGetVersion RtlLeaveCriticalSection RtlEnterCriticalSection RtlInitializeCriticalSection NtDuplicateObject NtWaitForSingleObject LdrGetDllHandle NtDelayExecution RtlFreeAnsiString RtlUnicodeStringToAnsiString NtOpenDirectoryObject RtlInitUnicodeString NtQuerySystemInformation NtQueryInformationProcess NtOpenSection NtProtectVirtualMemory NtUnmapViewOfSection NtClose RtlNtStatusToDosError LdrLoadDll RtlAddAccessAllowedAce

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_54b28ee01cf48b7e5336ff21b2158299_bkransomware_elex

kernel32

user32

ntdll

generic