2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc

General

Target
2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc
Size 636KB
Sample260812-e6v9vayeqf
SHA256 cf036ef6fe7cf3244ab98c4005487ec8df1c32ad5f8b53280e2341985af0160d
MD5 66c4081af5422558be47343652a522da
SHA1 761f7a68d35377cedbfad4fe2d14dc545043bfc0
SHA512 6eaf058ee39ad1b9075a04d9493dc93fda7fee112c3dc89a6115c09bf81c42d45a04cc95c2147a34821f2b3fa3b9ca0348544f4818d462aea5aca719e91906df
SSDEEP 12288:NEf8oiewXeTqmwJd0SdgX2bTuFop+UToITvLd42je:6fOdXuqmwX0yuE0o/bv5
TLSH
T14BD48C11B563A2B3D46225F6416DFB3A1A297E720F2D8BD3EBC70E5649F21C09633253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc

File Explorer

2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc

.exe 636KB

2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc

IMPHASH f948f51b4859254c496efeba1e11ae0d
SHA256 cf036ef6fe7cf3244ab98c4005487ec8df1c32ad5f8b53280e2341985af0160d
MD5 66c4081af5422558be47343652a522da
SHA1 761f7a68d35377cedbfad4fe2d14dc545043bfc0
SHA512 6eaf058ee39ad1b9075a04d9493dc93fda7fee112c3dc89a6115c09bf81c42d45a04cc95c2147a34821f2b3fa3b9ca0348544f4818d462aea5aca719e91906df
SSDEEP 12288:NEf8oiewXeTqmwJd0SdgX2bTuFop+UToITvLd42je:6fOdXuqmwX0yuE0o/bv5
TLSH
T14BD48C11B563A2B3D46225F6416DFB3A1A297E720F2D8BD3EBC70E5649F21C09633253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

376006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetProcAddress GetLastError HeapFree HeapAlloc HeapReAlloc EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetSystemTimeAsFileTime ReadFile GetFullPathNameW Beep Sleep DeleteFileW GetCommandLineA IsProcessorFeaturePresent GetProcessHeap GetStdHandle WriteFile GetModuleFileNameW IsDebuggerPresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FatalAppExitA UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime RtlUnwind GetCurrentThread GetCurrentThreadId GetConsoleCP GetConsoleMode CloseHandle GetFileType RaiseException GetStringTypeW SetStdHandle SetEnvironmentVariableA SetEnvironmentVariableW SetFilePointerEx ReadConsoleW GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringW HeapSize GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW WriteConsoleW FlushFileBuffers GetTimeZoneInformation GetFullPathNameA SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_66c4081af5422558be47343652a522da_bkransomware_elex_maze_stealc

kernel32

generic