2026-10-19_61bc8011cd5596067733633a7e325f10_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_61bc8011cd5596067733633a7e325f10_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys
Size 61.5MB
Sample261020-xd9wmsgz7n
SHA256 97242a2b7784edf1c5409d9a94a4746a9d7a2e448e21222c6a082fe9442ace09
MD5 61bc8011cd5596067733633a7e325f10
SHA1 95b721ce8b2e474ed32e1861912297a3365c1fb1
SHA512 1aec5bdd46a38c68c0e1bf67ed0d58d94a84363405dec4feb14151e129456a14f466420123367dbc1a1a0b7591a483f9c2dbcd0706ae298982945c1435c7bf70
SSDEEP 1572864:c+WHdkcdkD2r5DIfHu6MyLceFfaw2gUYKOSSX5szr:i9DG2ifH3Mygcfn2sSw5
TLSH
T10BE733053CA9D47BC0F11A7AFCA19E19067E7D30FA17D59B425DF882283B361BB38A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_61bc8011cd5596067733633a7e325f10_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

File Explorer

2026-10-19_61bc8011cd5596067733633a7e325f10_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

.exe 61.5MB

2026-10-19_61bc8011cd5596067733633a7e325f10_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

IMPHASH bfc730c2d43abf46afec90b7bbc869a7
SHA256 97242a2b7784edf1c5409d9a94a4746a9d7a2e448e21222c6a082fe9442ace09
MD5 61bc8011cd5596067733633a7e325f10
SHA1 95b721ce8b2e474ed32e1861912297a3365c1fb1
SHA512 1aec5bdd46a38c68c0e1bf67ed0d58d94a84363405dec4feb14151e129456a14f466420123367dbc1a1a0b7591a483f9c2dbcd0706ae298982945c1435c7bf70
SSDEEP 1572864:c+WHdkcdkD2r5DIfHu6MyLceFfaw2gUYKOSSX5szr:i9DG2ifH3Mygcfn2sSw5
TLSH
T10BE733053CA9D47BC0F11A7AFCA19E19067E7D30FA17D59B425DF882283B361BB38A45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

152383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildAgent\work\7838251580758eac\src\out\Release\full_installer.exe.pdb

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrust

crypt32

CryptDecodeObjectEx CryptImportPublicKeyInfo

wininet

InternetCrackUrlW InternetCanonicalizeUrlW InternetOpenW InternetCloseHandle InternetSetFilePointer HttpQueryInfoW InternetOpenUrlW InternetReadFile InternetSetStatusCallbackW

msimg32

AlphaBlend

psapi

GetProcessMemoryInfo

winmm

timeGetTime

shlwapi

UrlEscapeW

kernel32

GlobalAlloc SizeofResource GlobalUnlock GlobalFree LockResource HeapReAlloc HeapAlloc HeapFree GetProcessHeap HeapDestroy HeapSize GetModuleFileNameW SetFilePointer CreateProcessW WaitForSingleObject SetEvent GetTickCount WriteFile GetExitCodeProcess CreateFileW ResetEvent CreateEventW WaitForMultipleObjects CloseHandle DeleteFileW GetCurrentProcess LeaveCriticalSection FlushInstructionCache SetLastError EnterCriticalSection GetCurrentThreadId GetTempFileNameW GetFileSize SetEndOfFile FindResourceExW GetUserDefaultLangID GetFileAttributesW ReadFile GetTempPathW GetProcAddress GetModuleHandleA GetDiskFreeSpaceExW CreateMutexW GetModuleHandleW FormatMessageW OpenMutexW ReleaseMutex FreeLibrary LoadLibraryExW MultiByteToWideChar lstrcmpiW ExpandEnvironmentStringsW LoadLibraryW MapViewOfFile UnmapViewOfFile VirtualQuery CreateFileMappingW lstrcmpA GetCurrentProcessId IsDebuggerPresent OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot MoveFileExW GetCurrentDirectoryW GlobalLock SetCurrentDirectoryW QueryPerformanceCounter GetSystemTimeAsFileTime Sleep QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW CreateThread SetFilePointerEx FlushFileBuffers GetSystemDirectoryW GetWindowsDirectoryW GetModuleHandleExW GetEnvironmentVariableW SetEnvironmentVariableW TlsGetValue TlsSetValue TlsAlloc TlsFree HeapSetInformation VirtualFree EncodePointer IsProcessorFeaturePresent ExitThread WideCharToMultiByte GetConsoleCP GetConsoleMode ExitProcess GetFullPathNameW SetStdHandle GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW IsValidCodePage GetACP GetOEMCP GetCPInfo GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind WriteConsoleW ReadConsoleW GetStringTypeW OutputDebugStringW GetDriveTypeW SetEnvironmentVariableA LoadResource FindResourceW LocalFree GetCommandLineW DeleteCriticalSection DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount GetUserGeoID GetGeoInfoW LoadLibraryExA InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList VirtualAlloc

gdi32

GetTextExtentPoint32W SetViewportOrgEx BitBlt LPtoDP SetTextColor CreateDIBSection SetLayout SetBkMode GetStockObject DeleteDC GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap CreateFontW GetObjectW

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext RegCreateKeyExW CryptVerifySignatureW CryptDestroyHash CryptHashData CryptCreateHash CryptDestroyKey

ole32

CreateStreamOnHGlobal CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize StringFromGUID2 CoCreateGuid

oleaut32

VarUI4FromStr

user32

GetGuiResources UpdateLayeredWindow GetClassInfoExW RegisterClassExW CharNextW DestroyWindow GetWindowDC RegisterWindowMessageW PostMessageW InvalidateRect CreateWindowExW DialogBoxParamW GetActiveWindow FindWindowExW SetCursor LoadCursorW UnregisterClassW SendMessageW GetSystemMetrics IsWindow SetWindowPos GetDlgItem ReleaseDC GetDC LoadImageW GetWindowRect ScreenToClient GetWindow GetMonitorInfoW SetWindowTextW GetDlgCtrlID MapWindowPoints ShowWindow EndDialog SetWindowLongW MonitorFromWindow GetWindowLongW BeginPaint GetClientRect GetParent EndPaint CopyRect GetWindowTextW OffsetRect DrawTextW GetWindowTextLengthW DefWindowProcW CallWindowProcW

comctl32

InitCommonControlsEx

Name

.text

Size

247KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61.2MB

Virtual Size

61.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_61bc8011cd5596067733633a7e325f10_bkransomware_elex_glassworm_hawkeye_maze_remcos_rhadamanthys

wintrust

crypt32

wininet

msimg32

psapi

winmm

shlwapi

kernel32

gdi32

advapi32

ole32

oleaut32

user32

comctl32

generic