2026-10-26_6c15df6ec3d902ef8c889e1a645fc70f_bkransomware_elex_hawkeye_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_6c15df6ec3d902ef8c889e1a645fc70f_bkransomware_elex_hawkeye_maze_remcos
Size 452KB
Sample261027-she5lsdh22
SHA256 b7a89e658240a61ecd6ef74c4bf6c6da27158d2163f7317bd596b3aa7f7774a3
MD5 6c15df6ec3d902ef8c889e1a645fc70f
SHA1 cdb786bd2f09cefeab748a35ce544412067c00c2
SHA512 b28bb40fab843473aa4530d6e5e55e24b87aa7db43c3f871f357081a686e5c3a2c25b07ed6b5ef6cf300aa3221e3764de2115610283e17908163241fa230b451
SSDEEP 6144:voyZmTAsfJFakxaLjcMkc0Cax1P8Gp6bYA0w601+dNT9/0626ASkVOAFC:voyIJsMPrP5p6bYboEdNz
TLSH
T16EA4190277E89135F2F31B31AEB592615A7ABC719D35D20F23D41A0D0DB0A90EA79B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-26_6c15df6ec3d902ef8c889e1a645fc70f_bkransomware_elex_hawkeye_maze_remcos

File Explorer

2026-10-26_6c15df6ec3d902ef8c889e1a645fc70f_bkransomware_elex_hawkeye_maze_remcos

.exe 452KB

2026-10-26_6c15df6ec3d902ef8c889e1a645fc70f_bkransomware_elex_hawkeye_maze_remcos

IMPHASH 64ba7822df1bf2e5de512677c377f608
SHA256 b7a89e658240a61ecd6ef74c4bf6c6da27158d2163f7317bd596b3aa7f7774a3
MD5 6c15df6ec3d902ef8c889e1a645fc70f
SHA1 cdb786bd2f09cefeab748a35ce544412067c00c2
SHA512 b28bb40fab843473aa4530d6e5e55e24b87aa7db43c3f871f357081a686e5c3a2c25b07ed6b5ef6cf300aa3221e3764de2115610283e17908163241fa230b451
SSDEEP 6144:voyZmTAsfJFakxaLjcMkc0Cax1P8Gp6bYA0w601+dNT9/0626ASkVOAFC:voyIJsMPrP5p6bYboEdNz
TLSH
T16EA4190277E89135F2F31B31AEB592615A7ABC719D35D20F23D41A0D0DB0A90EA79B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e0:24:24:cc:61:36:d6:c0:e5:ee:9e:3b:14:79:7b:84:3e:25:36:79:18:b2:9b:c7:b6:52:33:26:a5:9a:b8:cd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat DC,O=Adobe Systems\, Incorporated,POSTALCODE=95110,STREET=345 Park Ave,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 4, 2017

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

06:89:83:64:2c:95:3e:46:f7:bd:ce:41:43:f1:33:c1

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 10, 2017 - Mar 15, 2019

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

134821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

LocalReAlloc GlobalFlags CompareStringW GetLocaleInfoW GetSystemDefaultUILanguage GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetErrorMode LoadLibraryExA GetCommandLineW GetSystemTimeAsFileTime RtlUnwind CreateThread ExitThread IsDebuggerPresent IsProcessorFeaturePresent SetStdHandle GetFileType ExitProcess GetModuleHandleExW LocalAlloc GetStdHandle GetStartupInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsValidCodePage GetOEMCP GetCPInfo GetStringTypeW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetTimeZoneInformation OutputDebugStringW LCMapStringW WriteConsoleW GetDriveTypeW SetEnvironmentVariableA GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileIntW lstrcmpA GetCurrentThread FileTimeToSystemTime FindNextFileW FileTimeToLocalFileTime DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose CreateFileW SuspendThread SetThreadPriority CreateEventW SetEvent GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW GetCurrentThreadId LeaveCriticalSection EnterCriticalSection EncodePointer MulDiv GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetModuleHandleA GetModuleFileNameW OutputDebugStringA GetACP WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer GetUserDefaultUILanguage GetVersionExW DeleteFileW GetTempFileNameW GetPrivateProfileStringW ExpandEnvironmentStringsW GetSystemInfo GetCurrentProcess FreeResource GetTempPathW GetCurrentDirectoryW GetSystemDirectoryW CreateProcessW CloseHandle WaitForSingleObject SetLastError GetLastError GetExitCodeProcess GetUserDefaultLangID LoadLibraryW Sleep ResumeThread FreeLibrary GetThreadPriority FindResourceW FormatMessageW SizeofResource LoadResource LocalFree LockResource SetDllDirectoryW SetCurrentDirectoryW GetSystemWindowsDirectoryW GetModuleHandleW GetProcAddress HeapQueryInformation

user32

InvalidateRect DestroyMenu RealChildWindowFromPoint ClientToScreen EndPaint BeginPaint TabbedTextOutW GrayStringW DrawTextExW DrawTextW LoadCursorW GetSysColorBrush ReleaseDC GetDC GetWindowThreadProcessId SetCursor PostQuitMessage GetSystemMetrics CharUpperW GetCursorPos TranslateMessage GetMessageW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW GetWindowRect GetClientRect RemovePropW GetPropW SetPropW ValidateRect SetForegroundWindow GetForegroundWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState IsWindowVisible CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetDesktopWindow SetActiveWindow GetActiveWindow GetNextDlgTabItem CreateDialogIndirectParamW DestroyWindow IsDialogMessageW GetWindow SetWindowLongW GetWindowLongW GetWindowTextW SetWindowTextW IsWindowEnabled GetFocus SetFocus AdjustWindowRectEx GetDlgCtrlID GetDlgItem SetWindowPos ShowWindow IsWindow GetMenuItemCount GetMenuItemID GetSubMenu GetParent SendDlgItemMessageA UnregisterClassW EndDialog PostMessageW EnableWindow KillTimer SetTimer SendMessageW RedrawWindow GetClassNameW

gdi32

TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx SelectObject CreateBitmap GetDeviceCaps SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteObject DeleteDC GetObjectW SetTextColor SetBkColor SetMapMode

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle InitiateSystemShutdownW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCreateKeyW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW StrFormatByteSizeW

ole32

CoCreateGuid CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysAllocString VariantChangeType VariantClear VariantInit SysFreeString

urlmon

URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_6c15df6ec3d902ef8c889e1a645fc70f_bkransomware_elex_hawkeye_maze_remcos

PE Signature issue

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

urlmon

generic