2026-08-10_e4b2d4a39d4bb9ec61e4e24789984522_bkransomware_elex_maze_rhadamanthys

General

Target
2026-08-10_e4b2d4a39d4bb9ec61e4e24789984522_bkransomware_elex_maze_rhadamanthys
Size 557KB
Sample260810-wp6spahf82
SHA256 1a2d8933176a4c742a4031e2545de9469d29bbaf91941e12a435ef7aa587cdff
MD5 e4b2d4a39d4bb9ec61e4e24789984522
SHA1 323fe7d2f4403108681a4a7fb029088a0b7645fa
SHA512 4ae91ef09a8305af56f871bf6cee5c0e596d14539a1bad7c6bebbec2919711b3efb4ecb8e8cf54374ecf8251fab2b75f8b411a4aa3859f52b4aeb36b5eb70f2d
SSDEEP 12288:hS0iyojliCQyB50WucFp2QlutUghgSdPYU+iK47HbFju:DiyqYI/0gOA2Usgib+K7Hbdu
TLSH
T182C42303B3D68572E1B00BB309618A216FAF3D369AB51D5637E0269E07761C0AF35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_e4b2d4a39d4bb9ec61e4e24789984522_bkransomware_elex_maze_rhadamanthys

File Explorer

2026-08-10_e4b2d4a39d4bb9ec61e4e24789984522_bkransomware_elex_maze_rhadamanthys

.exe 557KB

2026-08-10_e4b2d4a39d4bb9ec61e4e24789984522_bkransomware_elex_maze_rhadamanthys

IMPHASH 46ad3d954e527f769e37017b3e128039
SHA256 1a2d8933176a4c742a4031e2545de9469d29bbaf91941e12a435ef7aa587cdff
MD5 e4b2d4a39d4bb9ec61e4e24789984522
SHA1 323fe7d2f4403108681a4a7fb029088a0b7645fa
SHA512 4ae91ef09a8305af56f871bf6cee5c0e596d14539a1bad7c6bebbec2919711b3efb4ecb8e8cf54374ecf8251fab2b75f8b411a4aa3859f52b4aeb36b5eb70f2d
SSDEEP 12288:hS0iyojliCQyB50WucFp2QlutUghgSdPYU+iK47HbFju:DiyqYI/0gOA2Usgib+K7Hbdu
TLSH
T182C42303B3D68572E1B00BB309618A216FAF3D369AB51D5637E0269E07761C0AF35B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile ReadFile CreateFileW FlushFileBuffers GetLastError FindClose LocalAlloc GetLogicalDriveStringsW LocalFree CreateThread ExpandEnvironmentStringsW WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode CreateProcessW SetFilePointer GetDriveTypeW FindFirstFileW CreateMutexW GetFileSize GetEnvironmentVariableW FindNextFileW ExitProcess GetConsoleCP GetCommandLineW IsProcessorFeaturePresent SetLastError GetCurrentThreadId EncodePointer DecodePointer GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo IsDebuggerPresent LoadLibraryExW RtlUnwind OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW CloseHandle

user32

wsprintfW

advapi32

RegCloseKey CryptGenRandom RegCreateKeyW CryptAcquireContextW RegSetValueExW

ntdll

RtlAdjustPrivilege NtDelayExecution NtClose

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_e4b2d4a39d4bb9ec61e4e24789984522_bkransomware_elex_maze_rhadamanthys

kernel32

user32

advapi32

ntdll

generic