2026-09-04_4523a3cea3332146e5564a8fe65e99d1_bkransomware_elex_maze_rhadamanthys_smoke-loader

General

Target
2026-09-04_4523a3cea3332146e5564a8fe65e99d1_bkransomware_elex_maze_rhadamanthys_smoke-loader
Size 496KB
Sample260905-pp6dlacl7t
SHA256 344187928a8d2d2e5e3f358039649ac940880375525540d781c81b44c9e95dea
MD5 4523a3cea3332146e5564a8fe65e99d1
SHA1 04307ba071e1406a45dd64f8764af27d43daf13e
SHA512 02e73218a42bca4b468f6a98e0a105fa1f925f7a1e6e07332c768e03c7a139d21e77fd605815e36f531b31fc8391e3b83f468a412aa2c1a8977062ef0cbfe095
SSDEEP 6144:CER/W02O65ER/W0RO68iDBYmYVNETPkwdAGyFpItDmBvjOo4VI58DP:zt2J2tRJ8gYmYVNEIwdAGepsmBR41
TLSH
T16AB4E500B6E94224F1F36B76197565118ABBBDA6AE35CF4E129C054D4B3F980AE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_4523a3cea3332146e5564a8fe65e99d1_bkransomware_elex_maze_rhadamanthys_smoke-loader

File Explorer

2026-09-04_4523a3cea3332146e5564a8fe65e99d1_bkransomware_elex_maze_rhadamanthys_smoke-loader

.exe 496KB

2026-09-04_4523a3cea3332146e5564a8fe65e99d1_bkransomware_elex_maze_rhadamanthys_smoke-loader

IMPHASH 9b714c30ca18cf9de685e66d233930c0
SHA256 344187928a8d2d2e5e3f358039649ac940880375525540d781c81b44c9e95dea
MD5 4523a3cea3332146e5564a8fe65e99d1
SHA1 04307ba071e1406a45dd64f8764af27d43daf13e
SHA512 02e73218a42bca4b468f6a98e0a105fa1f925f7a1e6e07332c768e03c7a139d21e77fd605815e36f531b31fc8391e3b83f468a412aa2c1a8977062ef0cbfe095
SSDEEP 6144:CER/W02O65ER/W0RO68iDBYmYVNETPkwdAGyFpItDmBvjOo4VI58DP:zt2J2tRJ8gYmYVNEIwdAGepsmBR41
TLSH
T16AB4E500B6E94224F1F36B76197565118ABBBDA6AE35CF4E129C054D4B3F980AE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ashley\exe\release\plusstub.pdb

kernel32

GetLastError GlobalFree LockResource GlobalHandle GetModuleFileNameA CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP GetStdHandle GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc HeapSize RtlUnwind OutputDebugStringW GlobalUnlock IsDBCSLeadByte CreateProcessA GetExitCodeProcess GlobalAlloc SizeofResource SleepEx GlobalLock LoadResource FreeResource FlushFileBuffers FindResourceA HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte WriteFile GetModuleFileNameW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection FatalAppExitA HeapFree SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo CreateFileW

user32

EndPaint PostQuitMessage LoadStringA WaitForInputIdle wsprintfA GetClientRect BeginPaint MessageBoxA CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow ShowWindow DispatchMessageA SetWindowTextA UpdateWindow LoadCursorA RegisterClassA

gdi32

RealizePalette StretchDIBits SelectPalette SetStretchBltMode CreatePalette

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_4523a3cea3332146e5564a8fe65e99d1_bkransomware_elex_maze_rhadamanthys_smoke-loader

kernel32

user32

gdi32

advapi32

generic