2026-10-16_b03ecd8a8a50e9cf00473216850c2797_bkransomware_elex_maze_rhadamanthys

General

Target
2026-10-16_b03ecd8a8a50e9cf00473216850c2797_bkransomware_elex_maze_rhadamanthys
Size 1.5MB
Sample261017-k3m2ysc13y
SHA256 54270c8359a18f55fbcd008079bdbe57cd7790e4ff8f675d12fa7041c8662341
MD5 b03ecd8a8a50e9cf00473216850c2797
SHA1 84d1f969a8a870fdbc0ccc0afd0b73b6a6404108
SHA512 4cfa6120e6a52a9f9413ef7d479b6a07cf19582c524586617c4d8eb0f5ecd0d6b6cf94a9dc4906af9e40cf82fbdc2ca7361735e92e66ac198925cb34b3392ea3
SSDEEP 24576:5L3HXKDtd7mPuI7cpctubZ036++uCyoBf4bGdx7n9NC1NHnhCanS4:52DWPuIwIgSGD7XsVnrb
TLSH
T1837523707AC580B0D9A302B655F8C7F14A3F7D356B3A865EABCE5B4D06B4090F721B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_b03ecd8a8a50e9cf00473216850c2797_bkransomware_elex_maze_rhadamanthys

File Explorer

2026-10-16_b03ecd8a8a50e9cf00473216850c2797_bkransomware_elex_maze_rhadamanthys

.exe 1.5MB

2026-10-16_b03ecd8a8a50e9cf00473216850c2797_bkransomware_elex_maze_rhadamanthys

IMPHASH 0e4de7530fed6d5af872219465e2ea22
SHA256 54270c8359a18f55fbcd008079bdbe57cd7790e4ff8f675d12fa7041c8662341
MD5 b03ecd8a8a50e9cf00473216850c2797
SHA1 84d1f969a8a870fdbc0ccc0afd0b73b6a6404108
SHA512 4cfa6120e6a52a9f9413ef7d479b6a07cf19582c524586617c4d8eb0f5ecd0d6b6cf94a9dc4906af9e40cf82fbdc2ca7361735e92e66ac198925cb34b3392ea3
SSDEEP 24576:5L3HXKDtd7mPuI7cpctubZ036++uCyoBf4bGdx7n9NC1NHnhCanS4:52DWPuIwIgSGD7XsVnrb
TLSH
T1837523707AC580B0D9A302B655F8C7F14A3F7D356B3A865EABCE5B4D06B4090F721B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\wkimberl\Documents\Visual Studio 2013\Projects\QSaharaServer\Release\QSaharaServer.pdb

kernel32

CreateFileA ReadFile WriteFile CloseHandle SetCommTimeouts Sleep GetSystemInfo GetTickCount GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent FileTimeToLocalFileTime GetFileInformationByHandle GetFileType GetLastError PeekNamedPipe FileTimeToSystemTime EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte SetFilePointerEx GetCommandLineA GetTimeZoneInformation UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW GetCurrentThread GetCurrentThreadId SetStdHandle GetStdHandle DeleteCriticalSection FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime HeapFree GetFileAttributesExW CreateFileW FatalAppExitA GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapAlloc HeapReAlloc HeapSize HeapQueryInformation GetProcessHeap GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind GetConsoleCP GetConsoleMode GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW SetEndOfFile ReadConsoleW FlushFileBuffers OutputDebugStringW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW WriteConsoleW SetEnvironmentVariableA GetFullPathNameA CreateDirectoryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_b03ecd8a8a50e9cf00473216850c2797_bkransomware_elex_maze_rhadamanthys

kernel32

generic