2026-10-13_f5f11b1664ae123a1be84de230799179_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_wapomi

General

Target
2026-10-13_f5f11b1664ae123a1be84de230799179_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_wapomi
Size 87KB
Sample261014-bbhtgswxcv
SHA256 36eb4cd1f87c7ae5d82fd209ae365b46e5df7a0bd0abe1d862f29ff50e3d9797
MD5 f5f11b1664ae123a1be84de230799179
SHA1 a328276c88c04c634c92cb1f21ac54b144c66899
SHA512 830a6ea3ef56c499006e5242128c5332c31228a133c1b77d225048c3c64bd013d6ca5c6f61e079cebe3648bdf1d0bbb8a2be382bfba6d85f2eb6da346f2bf84f
SSDEEP 1536:CFGuNTmx7odcuRMRIcqxVk8Vc4AEZvzsWjcdRbBAGCq2iW7z:4xTU7oimJtAmv8RbKGCH
TLSH
T17E939E13B6D188B1E0B3163608F0DA614B3FBD220EB14D5B7788129E5EB91D19E35FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_f5f11b1664ae123a1be84de230799179_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_wapomi

File Explorer

2026-10-13_f5f11b1664ae123a1be84de230799179_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_wapomi

.exe 87KB

2026-10-13_f5f11b1664ae123a1be84de230799179_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_wapomi

IMPHASH 58a40a153f3c4b121ce0c5242887b32a
SHA256 36eb4cd1f87c7ae5d82fd209ae365b46e5df7a0bd0abe1d862f29ff50e3d9797
MD5 f5f11b1664ae123a1be84de230799179
SHA1 a328276c88c04c634c92cb1f21ac54b144c66899
SHA512 830a6ea3ef56c499006e5242128c5332c31228a133c1b77d225048c3c64bd013d6ca5c6f61e079cebe3648bdf1d0bbb8a2be382bfba6d85f2eb6da346f2bf84f
SSDEEP 1536:CFGuNTmx7odcuRMRIcqxVk8Vc4AEZvzsWjcdRbBAGCq2iW7z:4xTU7oimJtAmv8RbKGCH
TLSH
T17E939E13B6D188B1E0B3163608F0DA614B3FBD220EB14D5B7788129E5EB91D19E35FA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

90112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

SHGetValueA

user32

CharNextA wsprintfA CharPrevA MessageBoxA

shell32

SHGetFolderPathA

kernel32

WideCharToMultiByte CreateFileW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetModuleFileNameA WritePrivateProfileStringA CreateDirectoryA GetFileAttributesA GetACP IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress GetLastError GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection HeapFree IsValidCodePage GetOEMCP GetCPInfo LoadLibraryExW RtlUnwind OutputDebugStringW HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_f5f11b1664ae123a1be84de230799179_bkransomware_elex_karagany_maze_rhadamanthys_smoke-loader_wapomi

shlwapi

user32

shell32

kernel32

generic