2026-09-29_33519bf6f3bd47f2761fd8059e7b8664_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_33519bf6f3bd47f2761fd8059e7b8664_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys
Size 59.8MB
Sample260930-2azzgsbf99
SHA256 7f66f321830de4fa0c37301f003bd2cddeabcdd70c2b5f21e0d8281074ce5579
MD5 33519bf6f3bd47f2761fd8059e7b8664
SHA1 6566a3d80187a6e39c32b82e4b20cd4a9f82594c
SHA512 dbf48b5e08a78c1a4e486b141bd6019d71d3bd5c3bba38ea41a6616e3533b14e8b964f8394f87324cb1e32ca88d2428d7f60dbaf349bc4b48bc97546908f3431
SSDEEP 1572864:LOeAUmVJJeDPJilu9INOexOXUP43MwEU:6eAHJJcSC9exkU4cwE
TLSH
T1CCD73332EE0EC871C4B44E789DB2667942BC7DB2A236D01B6314FC953AF22E1E934755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_33519bf6f3bd47f2761fd8059e7b8664_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

File Explorer

2026-09-29_33519bf6f3bd47f2761fd8059e7b8664_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

.exe 59.8MB

2026-09-29_33519bf6f3bd47f2761fd8059e7b8664_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

IMPHASH bc6e4fef1d61956be6eafa1a811f9ef0
SHA256 7f66f321830de4fa0c37301f003bd2cddeabcdd70c2b5f21e0d8281074ce5579
MD5 33519bf6f3bd47f2761fd8059e7b8664
SHA1 6566a3d80187a6e39c32b82e4b20cd4a9f82594c
SHA512 dbf48b5e08a78c1a4e486b141bd6019d71d3bd5c3bba38ea41a6616e3533b14e8b964f8394f87324cb1e32ca88d2428d7f60dbaf349bc4b48bc97546908f3431
SSDEEP 1572864:LOeAUmVJJeDPJilu9INOexOXUP43MwEU:6eAHJJcSC9exkU4cwE
TLSH
T1CCD73332EE0EC871C4B44E789DB2667942BC7DB2A236D01B6314FC953AF22E1E934755
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135923

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\7838251580758eac\src\out\Release\full_installer.exe.pdb

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrust

crypt32

CryptDecodeObjectEx CryptImportPublicKeyInfo

wininet

InternetCloseHandle InternetSetFilePointer HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetCanonicalizeUrlW InternetOpenW InternetOpenUrlW InternetSetStatusCallbackW

msimg32

AlphaBlend

psapi

GetProcessMemoryInfo

winmm

timeGetTime

shlwapi

UrlEscapeW

kernel32

HeapReAlloc HeapAlloc HeapFree GetProcessHeap HeapDestroy HeapSize GetModuleFileNameW SetFilePointer CreateProcessW WaitForSingleObject SetEvent GetTickCount WriteFile GetExitCodeProcess CreateFileW ResetEvent CreateEventW WaitForMultipleObjects CloseHandle DeleteFileW GetCurrentProcess LeaveCriticalSection FlushInstructionCache SetLastError EnterCriticalSection GetCurrentThreadId GetTempFileNameW GetFileSize SetEndOfFile FindResourceExW GetUserDefaultLangID GetFileAttributesW ReadFile GetTempPathW GetProcAddress GetModuleHandleA CreateMutexW GetModuleHandleW FormatMessageW OpenMutexW ReleaseMutex FreeLibrary LoadLibraryExW MultiByteToWideChar lstrcmpiW ExpandEnvironmentStringsW LoadLibraryW MapViewOfFile UnmapViewOfFile VirtualQuery CreateFileMappingW lstrcmpA GetCurrentProcessId IsDebuggerPresent OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot MoveFileExW LockResource SetCurrentDirectoryW SetUnhandledExceptionFilter GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW Sleep CreateThread SetFilePointerEx FlushFileBuffers GetModuleHandleExW TlsGetValue TlsSetValue TlsAlloc TlsFree SetEnvironmentVariableA GlobalFree GlobalUnlock SizeofResource GlobalAlloc GlobalLock LoadResource FindResourceW LocalFree GetCommandLineW DeleteCriticalSection DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount GetUserGeoID GetGeoInfoW SetStdHandle GetFileType GetCurrentDirectoryW RtlUnwind TerminateProcess GetStartupInfoW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter WriteConsoleW ExitProcess GetConsoleMode GetConsoleCP ExitThread VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW GetStringTypeW EncodePointer WideCharToMultiByte LoadLibraryExA

gdi32

SetLayout LPtoDP BitBlt SetViewportOrgEx GetTextExtentPoint32W SetTextColor SetBkMode GetStockObject DeleteDC GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap CreateFontW GetObjectW CreateDIBSection

advapi32

CryptHashData CryptVerifySignatureW CryptDestroyHash RegCreateKeyExW CryptCreateHash CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW

ole32

CoCreateGuid StringFromGUID2 CoInitialize CoUninitialize CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoCreateInstance CreateStreamOnHGlobal

oleaut32

VarUI4FromStr

user32

EndDialog SetWindowLongW MonitorFromWindow GetWindowLongW BeginPaint GetClientRect GetParent EndPaint CopyRect GetWindowTextW OffsetRect DrawTextW GetWindowTextLengthW DefWindowProcW CallWindowProcW LoadCursorW SetCursor FindWindowExW GetActiveWindow DialogBoxParamW CreateWindowExW InvalidateRect ShowWindow RegisterWindowMessageW GetWindowDC DestroyWindow CharNextW RegisterClassExW GetClassInfoExW UpdateLayeredWindow GetGuiResources SetWindowPos IsWindow GetSystemMetrics SendMessageW UnregisterClassW MapWindowPoints GetDlgCtrlID SetWindowTextW GetMonitorInfoW GetWindow ScreenToClient GetWindowRect LoadImageW GetDC ReleaseDC PostMessageW GetDlgItem

comctl32

InitCommonControlsEx

Name

.text

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59.5MB

Virtual Size

59.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_33519bf6f3bd47f2761fd8059e7b8664_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

wintrust

crypt32

wininet

msimg32

psapi

winmm

shlwapi

kernel32

gdi32

advapi32

ole32

oleaut32

user32

comctl32

generic