2026-09-16_b40cc5266723788540634209668d6acf_bkransomware_elex_floxif_karagany_rhadamanthys

General

Target
2026-09-16_b40cc5266723788540634209668d6acf_bkransomware_elex_floxif_karagany_rhadamanthys
Size 159KB
Sample260916-wf87fsbh75
SHA256 370e1d0d591e533d29001eb2b0cc6e5c74b9a5b7c7af1a45e1d41e693d0b8a8e
MD5 b40cc5266723788540634209668d6acf
SHA1 729f09ab410195c2cf01e47da2278af2dc88bd2c
SHA512 3669ec912255c6876da8273d25f40bc6782bab81d231c0558d1b4179ed2bfa4389116456e497f6d5886ff4c0c0f675a8606a113aaf61bf07ab93fe251c6e4e14
SSDEEP 3072:ynHlF4Ce0XRku/I2lQBV+UdE+rECWp7hK4NE:yHlt2BV+UdvrEFp7hKH
TLSH
T195F3BF0232D083FDE0F20A353468AA1149FEFD3D0DBF855BA755014E5E6C6929F99B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_b40cc5266723788540634209668d6acf_bkransomware_elex_floxif_karagany_rhadamanthys

File Explorer

2026-09-16_b40cc5266723788540634209668d6acf_bkransomware_elex_floxif_karagany_rhadamanthys

.exe 159KB

2026-09-16_b40cc5266723788540634209668d6acf_bkransomware_elex_floxif_karagany_rhadamanthys

IMPHASH 0fcb0bee3038d7dd4e01dcce746e31ed
SHA256 370e1d0d591e533d29001eb2b0cc6e5c74b9a5b7c7af1a45e1d41e693d0b8a8e
MD5 b40cc5266723788540634209668d6acf
SHA1 729f09ab410195c2cf01e47da2278af2dc88bd2c
SHA512 3669ec912255c6876da8273d25f40bc6782bab81d231c0558d1b4179ed2bfa4389116456e497f6d5886ff4c0c0f675a8606a113aaf61bf07ab93fe251c6e4e14
SSDEEP 3072:ynHlF4Ce0XRku/I2lQBV+UdE+rECWp7hK4NE:yHlt2BV+UdvrEFp7hKH
TLSH
T195F3BF0232D083FDE0F20A353468AA1149FEFD3D0DBF855BA755014E5E6C6929F99B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

03:35:74:c4:a5:ce:65:3c:30:65:01:10:92:38:06:3e:12:a9:5f:10

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Chains

Sep 15, 2026

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Serial Number

7d:08:d9:bc:13:07:26:de:26:ee:4e:f2:8e:13:30:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 31, 2012 - Aug 3, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

6

Entry point

6607

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ZH\Desktop\Setup\Release\Setup.pdb

newdev

UpdateDriverForPlugAndPlayDevicesW

kernel32

FreeEnvironmentStringsW CreateFileW GetLastError FormatMessageW LocalAlloc lstrlenW LocalSize LocalFree ExitProcess GetConsoleWindow GetModuleFileNameW GetVersionExW FindFirstFileW CopyFileW LCMapStringW GetCommandLineW IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection SetLastError GetCurrentThreadId GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetConsoleCP GetConsoleMode SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCPInfo HeapFree RtlUnwind LoadLibraryExW OutputDebugStringW SetStdHandle WriteConsoleW GetStringTypeW HeapAlloc HeapReAlloc FlushFileBuffers HeapSize

user32

ShowWindow

shell32

ShellExecuteW SHGetKnownFolderPath

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_b40cc5266723788540634209668d6acf_bkransomware_elex_floxif_karagany_rhadamanthys

PE Signature issue

newdev

kernel32

user32

shell32

generic