2026-09-30_030ddcab6c74375977015d1ffc51c81a_bkransomware_elex_maze_rhadamanthys_smoke-loader

General

Target
2026-09-30_030ddcab6c74375977015d1ffc51c81a_bkransomware_elex_maze_rhadamanthys_smoke-loader
Size 475KB
Sample260930-rt2mbasw9l
SHA256 0f323017f330b9e7d60f24fc45e45cc4e8a9190a15b698493b0a2876305665a9
MD5 030ddcab6c74375977015d1ffc51c81a
SHA1 64895183fb49d3c932b70c88ed9e76eac8972015
SHA512 c4f31b1125423e04b9e9650e89502878341f80b2a7d1c374768f3c66a9e6470d5a61a50582f9ed02beaf6b20aa8fe5ad10f1fa0520330fbf7b56fb0b1a41e7b5
SSDEEP 6144:CER/W0fO6ZER/W0RO69PsVgwMqOIMDJvDUuI2D:ztfJWtRJ+VgwMq/cdDUq
TLSH
T15FA41902B6EA4220F0F35779147556618B3BBD65AE3A8E5E128C140D4FFB580AE71FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_030ddcab6c74375977015d1ffc51c81a_bkransomware_elex_maze_rhadamanthys_smoke-loader

File Explorer

2026-09-30_030ddcab6c74375977015d1ffc51c81a_bkransomware_elex_maze_rhadamanthys_smoke-loader

.exe 475KB

2026-09-30_030ddcab6c74375977015d1ffc51c81a_bkransomware_elex_maze_rhadamanthys_smoke-loader

IMPHASH 9b714c30ca18cf9de685e66d233930c0
SHA256 0f323017f330b9e7d60f24fc45e45cc4e8a9190a15b698493b0a2876305665a9
MD5 030ddcab6c74375977015d1ffc51c81a
SHA1 64895183fb49d3c932b70c88ed9e76eac8972015
SHA512 c4f31b1125423e04b9e9650e89502878341f80b2a7d1c374768f3c66a9e6470d5a61a50582f9ed02beaf6b20aa8fe5ad10f1fa0520330fbf7b56fb0b1a41e7b5
SSDEEP 6144:CER/W0fO6ZER/W0RO69PsVgwMqOIMDJvDUuI2D:ztfJWtRJ+VgwMq/cdDUq
TLSH
T15FA41902B6EA4220F0F35779147556618B3BBD65AE3A8E5E128C140D4FFB580AE71FB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ashley\exe\release\plusstub.pdb

kernel32

GetLastError GlobalFree LockResource GlobalHandle GetModuleFileNameA CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP GetStdHandle GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapReAlloc HeapSize RtlUnwind OutputDebugStringW GlobalUnlock IsDBCSLeadByte CreateProcessA GetExitCodeProcess GlobalAlloc SizeofResource SleepEx GlobalLock LoadResource FreeResource FlushFileBuffers FindResourceA HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte WriteFile GetModuleFileNameW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection FatalAppExitA HeapFree SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo CreateFileW

user32

EndPaint PostQuitMessage LoadStringA WaitForInputIdle wsprintfA GetClientRect BeginPaint MessageBoxA CreateWindowExA PeekMessageA DefWindowProcA GetDesktopWindow ShowWindow DispatchMessageA SetWindowTextA UpdateWindow LoadCursorA RegisterClassA

gdi32

RealizePalette StretchDIBits SelectPalette SetStretchBltMode CreatePalette

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_030ddcab6c74375977015d1ffc51c81a_bkransomware_elex_maze_rhadamanthys_smoke-loader

kernel32

user32

gdi32

advapi32

generic