2026-10-21_8ff8bbb64837d97301485a05992e5458_bkransomware_coinminer_elex_maze_rugmi

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_8ff8bbb64837d97301485a05992e5458_bkransomware_coinminer_elex_maze_rugmi
Size 1.0MB
Sample261022-v5avhswt8m
SHA256 9af57952643b460780e53a07fc93998f7c18d87cac89ffb4b267a05f1b44a4ad
MD5 8ff8bbb64837d97301485a05992e5458
SHA1 9362db9396909e5e8b9f08fd8e9cf6d8e5dd73ae
SHA512 66abfe623316ec34d89f6e91e593837c0a380623facac90cbf871046a3c61f35a9ba66ecf027b5bbd22070f75b9a372162b7002dd1ddcae981c4da4780c3928d
SSDEEP 24576:uLrQLxKTS1/T7b3m1QYk7qpJ59jwQXFTS4UvcJ:arQT1/DztGpHtX2n0
TLSH
T11F25AEF3A5505331E6FE0DB3AD5CA1306D6CAE18371C856AA7D8BD0F29B848177B7206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_8ff8bbb64837d97301485a05992e5458_bkransomware_coinminer_elex_maze_rugmi

File Explorer

2026-10-21_8ff8bbb64837d97301485a05992e5458_bkransomware_coinminer_elex_maze_rugmi

.exe 1.0MB

2026-10-21_8ff8bbb64837d97301485a05992e5458_bkransomware_coinminer_elex_maze_rugmi

IMPHASH d18cde94cdc6e930f022e2819d39a2bd
SHA256 9af57952643b460780e53a07fc93998f7c18d87cac89ffb4b267a05f1b44a4ad
MD5 8ff8bbb64837d97301485a05992e5458
SHA1 9362db9396909e5e8b9f08fd8e9cf6d8e5dd73ae
SHA512 66abfe623316ec34d89f6e91e593837c0a380623facac90cbf871046a3c61f35a9ba66ecf027b5bbd22070f75b9a372162b7002dd1ddcae981c4da4780c3928d
SSDEEP 24576:uLrQLxKTS1/T7b3m1QYk7qpJ59jwQXFTS4UvcJ:arQT1/DztGpHtX2n0
TLSH
T11F25AEF3A5505331E6FE0DB3AD5CA1306D6CAE18371C856AA7D8BD0F29B848177B7206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

229129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\bamboo-build\LAUN-WCC171-JOB1\3rdParty\wix\wix3.10.4-sources\build\ship\x86\burn.pdb

advapi32

OpenProcessToken GetTokenInformation AllocateAndInitializeSid CheckTokenMembership RegCloseKey RegOpenKeyExW CreateWellKnownSid InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW DecryptFileW SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetEntriesInAclA SetSecurityDescriptorGroup CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

PeekMessageW PostMessageW IsWindow WaitForInputIdle MessageBoxW GetMessageW MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW TranslateMessage PostQuitMessage

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdi32

StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC GetObjectW

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoInitializeSecurity CLSIDFromProgID

kernel32

TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStartupInfoW GetFileType GetACP GetOEMCP GetCPInfo UnhandledExceptionFilter LoadLibraryExW GetStdHandle DecodePointer EncodePointer SetLastError IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW SystemTimeToFileTime CloseHandle CreateFileW GetProcAddress LocalFree HeapSetInformation GetLastError GetModuleHandleW FormatMessageW lstrlenA lstrlenW MultiByteToWideChar WideCharToMultiByte LCMapStringW Sleep GetLocalTime GetModuleFileNameW RtlUnwind GetTempPathW GetTempFileNameW CreateDirectoryW GetFullPathNameW CompareStringW GetCurrentProcess GetVersionExW GetCurrentProcessId WriteFile SetFilePointer LoadLibraryW GetSystemDirectoryW CreateFileA HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindClose SetCurrentDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW MoveFileExW FreeLibrary GlobalAlloc GlobalFree GetFileSizeEx ReadFile SetFilePointerEx SetFileTime CopyFileW GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection ReleaseMutex TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW VerSetConditionMask EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo GetModuleHandleExW GetWindowsDirectoryW GetSystemWow64DirectoryW GetComputerNameW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW DuplicateHandle InterlockedExchange InterlockedCompareExchange CreateEventW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile LocalFileTimeToFileTime DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale GetTimeZoneInformation SystemTimeToTzSpecificLocalTime OutputDebugStringW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW ExpandEnvironmentStringsW GetSystemTimeAsFileTime VirtualFree VirtualAlloc GetModuleHandleA ExitProcess LoadLibraryExA RaiseException FlushFileBuffers

rpcrt4

UuidCreate

Name

.text

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_8ff8bbb64837d97301485a05992e5458_bkransomware_coinminer_elex_maze_rugmi

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

rpcrt4

generic