2026-10-26_c5d8ed748531b8594b8bb83f8d4852f5_bkransomware_elex_hawkeye_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_c5d8ed748531b8594b8bb83f8d4852f5_bkransomware_elex_hawkeye_maze_remcos
Size 1.2MB
Sample261027-h2wllabs7w
SHA256 9ef6baa436dffa779eb99b74691392fb08d7f03c741d535c3cbe8864d61cfeae
MD5 c5d8ed748531b8594b8bb83f8d4852f5
SHA1 d8b98b140de11bcd7350fa1c2e95bef8c2132954
SHA512 e39c15fcc47d3488790f83fc3e618dc96ff14b055d068b4ccd05caf2f5d6414535143a971d7f0a9c9098d34deaf679de460336decb92683280fbd0526d748780
SSDEEP 12288:Bg49H6BMwZJXoAdp28+U0L6PbEMv8W9imisNclwyW25bVI1UdxpvffuSit4TW2Uo:a49H6q2oN8gL6jb8WncOyHEgZla48QpR
TLSH
T19145D002B7F9A134F5F31B30AEB952645A7BBD629D35D60E23C4160D0DB0A80EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_c5d8ed748531b8594b8bb83f8d4852f5_bkransomware_elex_hawkeye_maze_remcos

File Explorer

2026-10-26_c5d8ed748531b8594b8bb83f8d4852f5_bkransomware_elex_hawkeye_maze_remcos

.exe 1.2MB

2026-10-26_c5d8ed748531b8594b8bb83f8d4852f5_bkransomware_elex_hawkeye_maze_remcos

IMPHASH 8dabae1d6eec46ac286f7071178eab44
SHA256 9ef6baa436dffa779eb99b74691392fb08d7f03c741d535c3cbe8864d61cfeae
MD5 c5d8ed748531b8594b8bb83f8d4852f5
SHA1 d8b98b140de11bcd7350fa1c2e95bef8c2132954
SHA512 e39c15fcc47d3488790f83fc3e618dc96ff14b055d068b4ccd05caf2f5d6414535143a971d7f0a9c9098d34deaf679de460336decb92683280fbd0526d748780
SSDEEP 12288:Bg49H6BMwZJXoAdp28+U0L6PbEMv8W9imisNclwyW25bVI1UdxpvffuSit4TW2Uo:a49H6q2oN8gL6jb8WncOyHEgZla48QpR
TLSH
T19145D002B7F9A134F5F31B30AEB952645A7BBD629D35D60E23C4160D0DB0A80EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

138273

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

LocalReAlloc GlobalFlags CompareStringW GetLocaleInfoW GetSystemDefaultUILanguage GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetErrorMode LoadLibraryExA GetCommandLineW GetSystemTimeAsFileTime RtlUnwind CreateThread ExitThread IsDebuggerPresent IsProcessorFeaturePresent SetStdHandle GetFileType ExitProcess GetModuleHandleExW LocalAlloc GetStdHandle GetStartupInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsValidCodePage GetOEMCP GetCPInfo GetStringTypeW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetTimeZoneInformation OutputDebugStringW LCMapStringW WriteConsoleW GetDriveTypeW SetEnvironmentVariableA GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileIntW lstrcmpA GetCurrentThread FileTimeToSystemTime FindNextFileW FileTimeToLocalFileTime DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose SuspendThread SetThreadPriority CreateEventW SetEvent GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW GetCurrentThreadId LeaveCriticalSection EnterCriticalSection EncodePointer MulDiv GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetModuleHandleA GetModuleFileNameW OutputDebugStringA GetACP WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer GetUserDefaultUILanguage GetVersionExW DeleteFileW GetTempFileNameW GetPrivateProfileStringW ExpandEnvironmentStringsW GetSystemInfo GetCurrentProcess FreeResource GetTempPathW CopyFileW CreateFileW GetCurrentDirectoryW GetSystemDirectoryW CreateProcessW CloseHandle WaitForSingleObject SetLastError GetLastError GetExitCodeProcess GetUserDefaultLangID LoadLibraryW Sleep ResumeThread FreeLibrary GetThreadPriority FindResourceW FormatMessageW SizeofResource LoadResource LocalFree LockResource SetDllDirectoryW SetCurrentDirectoryW GetSystemWindowsDirectoryW GetModuleHandleW GetProcAddress HeapQueryInformation

user32

InvalidateRect DestroyMenu RealChildWindowFromPoint ClientToScreen EndPaint BeginPaint TabbedTextOutW GrayStringW DrawTextExW DrawTextW LoadCursorW GetSysColorBrush ReleaseDC GetDC GetWindowThreadProcessId SetCursor PostQuitMessage GetSystemMetrics CharUpperW GetCursorPos TranslateMessage GetMessageW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW GetWindowRect GetClientRect RemovePropW GetPropW SetPropW ValidateRect SetForegroundWindow GetForegroundWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState IsWindowVisible CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetDesktopWindow SetActiveWindow GetActiveWindow GetNextDlgTabItem CreateDialogIndirectParamW DestroyWindow IsDialogMessageW GetWindow SetWindowLongW GetWindowLongW GetWindowTextW SetWindowTextW IsWindowEnabled GetFocus SetFocus AdjustWindowRectEx GetDlgCtrlID GetDlgItem SetWindowPos ShowWindow IsWindow GetMenuItemCount GetMenuItemID GetSubMenu GetParent SendDlgItemMessageA UnregisterClassW EndDialog PostMessageW EnableWindow KillTimer SetTimer SendMessageW RedrawWindow GetClassNameW

gdi32

TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx SelectObject CreateBitmap GetDeviceCaps SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject DeleteDC GetObjectW SetTextColor SetBkColor SetMapMode

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle InitiateSystemShutdownW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCreateKeyW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW StrFormatByteSizeW

ole32

CoCreateGuid CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysAllocString VariantChangeType VariantClear VariantInit SysFreeString

urlmon

URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_c5d8ed748531b8594b8bb83f8d4852f5_bkransomware_elex_hawkeye_maze_remcos

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

urlmon

generic