2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys

General

Target
2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys
Size 1.4MB
Sample260930-e4gnnsxcrh
SHA256 287d680d090145eb863f1506179d2903cecf23d3edcbb09d72bef5485030c915
MD5 20fdd2590dfc1ffab25a86017aacfc41
SHA1 1e5baf3f404d31727caa9f2b83433cf74b35f3f1
SHA512 5daed660c21bfcb2e82da1c34b805efe9af44cb06bd2040e1f45f80dfbcb887aee96611b272d5982b7cee97531f588b61f44623d3b8f4e0ce12a26409681bff8
SSDEEP 24576:2GaKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPH:2GarSj8RoTCCrfJ4klKXn/
TLSH
T1546523A7B2C08570D8671BB42EA8E4441A5B7FCD591F465E9EC028CD6EFE2E11E3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys

File Explorer

2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys

.exe 1.4MB

2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys

IMPHASH 60e7b9a949b17864787003723fbddff6
SHA256 287d680d090145eb863f1506179d2903cecf23d3edcbb09d72bef5485030c915
MD5 20fdd2590dfc1ffab25a86017aacfc41
SHA1 1e5baf3f404d31727caa9f2b83433cf74b35f3f1
SHA512 5daed660c21bfcb2e82da1c34b805efe9af44cb06bd2040e1f45f80dfbcb887aee96611b272d5982b7cee97531f588b61f44623d3b8f4e0ce12a26409681bff8
SSDEEP 24576:2GaKngL2jdshRTdG1YxITqvfPkbIcbjLbfJ4yL/tNCJPXUQrPH:2GarSj8RoTCCrfJ4klKXn/
TLSH
T1546523A7B2C08570D8671BB42EA8E4441A5B7FCD591F465E9EC028CD6EFE2E11E3C712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5233

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\source\NetMonitor3\Bin\server\spload32.pdb

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

user32

TranslateAcceleratorA DispatchMessageA TranslateMessage GetMessageA GetDesktopWindow

kernel32

CreateFileW WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP CloseHandle GetLastError CreateMutexA GetCurrentProcess GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryA CreateToolhelp32Snapshot Process32First Process32Next GetCommandLineA IsDebuggerPresent IsProcessorFeaturePresent SetLastError GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile GetModuleFileNameW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW RtlUnwind OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_20fdd2590dfc1ffab25a86017aacfc41_bkransomware_elex_karagany_maze_rhadamanthys

advapi32

user32

kernel32

generic