General
- Target 2026-08-12_ce84f0b318c15dd44e6c572ea9a4029c_bkransomware_elex_maze
- Size 3.5MB
- Sample260813-ad176sfe26
- SHA256 0ccdf4fb0cb575ce15eda67c8fdb6855e98f99e3008792a7cfd4961197094820
- MD5 ce84f0b318c15dd44e6c572ea9a4029c
- SHA1 7349178b78736516874890b8ade1572d9b08ed0b
- SHA512 dcec3fa66a3a293145dc73c0ed4214d00cf627c95c8bbe2b5f5984dd52a347d695c0b0d497c22bdc81664989c459138ffcdba4a880ba61e624d1a853165a9d46
- SSDEEP 49152:nreVg/B2tQ25amRUsjhcbEozzkEAgmY6yboR7RD/:re6UtofsjSz3bgY6y67RD/
- TLSH T135062211F282FBDEFCD20470A79996F201242E34583AD8537AC43E19F1BA5D5922BB77
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-12_ce84f0b318c15dd44e6c572ea9a4029c_bkransomware_elex_maze.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_ce84f0b318c15dd44e6c572ea9a4029c_bkransomware_elex_maze.exe
Resource
win11ltsc2024-20260710-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_ce84f0b318c15dd44e6c572ea9a4029c_bkransomware_elex_maze
- Size 3.5MB
- SHA256 0ccdf4fb0cb575ce15eda67c8fdb6855e98f99e3008792a7cfd4961197094820
- MD5 ce84f0b318c15dd44e6c572ea9a4029c
- SHA1 7349178b78736516874890b8ade1572d9b08ed0b
- SHA512 dcec3fa66a3a293145dc73c0ed4214d00cf627c95c8bbe2b5f5984dd52a347d695c0b0d497c22bdc81664989c459138ffcdba4a880ba61e624d1a853165a9d46
- SSDEEP 49152:nreVg/B2tQ25amRUsjhcbEozzkEAgmY6yboR7RD/:re6UtofsjSz3bgY6y67RD/
- TLSH T135062211F282FBDEFCD20470A79996F201242E34583AD8537AC43E19F1BA5D5922BB77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Detects binaries and memory artifacts referencing sandbox product IDs
-
Enumerates VirtualBox registry keys
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Stops running service(s)
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Modify Registry
1Virtualization/Sandbox Evasion
1