2026-08-31_892c7a07a1193fe06a8b2fdfb5a571bc_bkransomware_elex_maze_rhadamanthys_smoke-loader_wapomi

General

Target
2026-08-31_892c7a07a1193fe06a8b2fdfb5a571bc_bkransomware_elex_maze_rhadamanthys_smoke-loader_wapomi
Size 215KB
Sample260831-v5ajrazvbw
SHA256 82048c7d19479ad6dfeda6c504f705b7ee6b70022370e63660383e3cba325b32
MD5 892c7a07a1193fe06a8b2fdfb5a571bc
SHA1 312c68e66bdc2cbec13e56f20853107c57db224e
SHA512 6693c858c55db8a100c4c75d35c8e4ccc12914f4c202f319b3be58d570a86f11ca92f58f2f46f302c310c77769bd38cbe90c38b811f672a09f57a41a872b839e
SSDEEP 3072:J666SmGgfYMSLpt690G4EHI8FeqvrvuSUdyfQHoAb3MVD+Q3KuGCH:J2SSI60GhHvjv1Q83KH
TLSH
T105248D3275D0C031D8B3027A45E8D7724A7EBE715B368A9BB7EC0A4D56344D0B736BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_892c7a07a1193fe06a8b2fdfb5a571bc_bkransomware_elex_maze_rhadamanthys_smoke-loader_wapomi

File Explorer

2026-08-31_892c7a07a1193fe06a8b2fdfb5a571bc_bkransomware_elex_maze_rhadamanthys_smoke-loader_wapomi

.exe 215KB

2026-08-31_892c7a07a1193fe06a8b2fdfb5a571bc_bkransomware_elex_maze_rhadamanthys_smoke-loader_wapomi

IMPHASH c63863cfe9f7fd33f41e87def56ace6b
SHA256 82048c7d19479ad6dfeda6c504f705b7ee6b70022370e63660383e3cba325b32
MD5 892c7a07a1193fe06a8b2fdfb5a571bc
SHA1 312c68e66bdc2cbec13e56f20853107c57db224e
SHA512 6693c858c55db8a100c4c75d35c8e4ccc12914f4c202f319b3be58d570a86f11ca92f58f2f46f302c310c77769bd38cbe90c38b811f672a09f57a41a872b839e
SSDEEP 3072:J666SmGgfYMSLpt690G4EHI8FeqvrvuSUdyfQHoAb3MVD+Q3KuGCH:J2SSI60GhHvjv1Q83KH
TLSH
T105248D3275D0C031D8B3027A45E8D7724A7EBE715B368A9BB7EC0A4D56344D0B736BA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

225280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\wkimberl\Documents\Visual Studio 2013\Projects\QSaharaServer\Release\QSaharaServer.pdb

kernel32

WriteFile ReadFile CloseHandle SetCommTimeouts CreateFileA Sleep GetSystemInfo GetTickCount GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent FileTimeToLocalFileTime GetFileInformationByHandle GetFileType GetLastError PeekNamedPipe FileTimeToSystemTime EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte SetFilePointerEx GetCommandLineA GetTimeZoneInformation UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId SetStdHandle GetStdHandle DeleteCriticalSection FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime HeapFree GetFileAttributesExW CreateFileW FatalAppExitA GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapAlloc HeapReAlloc HeapSize HeapQueryInformation GetProcessHeap GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind GetConsoleCP GetConsoleMode GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW SetEndOfFile ReadConsoleW FlushFileBuffers OutputDebugStringW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW WriteConsoleW SetEnvironmentVariableA GetFullPathNameA CreateDirectoryW

Name

.text

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��ţuO

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_892c7a07a1193fe06a8b2fdfb5a571bc_bkransomware_elex_maze_rhadamanthys_smoke-loader_wapomi

kernel32

generic