General
- Target 2026-03-29_0c9efe61601a3d1b5143da35c52140cd_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
- Size 688KB
- Sample260329-d2j6cads9v
- SHA256 7a68cf889617d8bea05f8a594c0d747cf5594aa3d7a5a0dc7332b9f1681f4505
- MD5 0c9efe61601a3d1b5143da35c52140cd
- SHA1 fda84b317297b437f7aeb9bc0fe8e0c8058e97f0
- SHA512 e71c8ace31d23024edc076eb72c40ced87bb8ea7a1a5f577e0943be9e4358f9c841dbf96c32a69301d9e8e3bf05382e6a1bf4b554b52279c5294cf67c2c4a598
- SSDEEP 6144:DdaBL6CRJTOvRuU9QXPB7vOUjBCEqOttJMJaJlJKJiJ+JpJaJGJgJ5J9JYJ4JYJ4:Dd8mCRY9QXAUjkENt/
- TLSH T1E7E46D9226F81CD6E58F1B3C19B145678DA0FA70443A663615C8E88F0DAFDE3467C7B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-03-29_0c9efe61601a3d1b5143da35c52140cd_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-03-29_0c9efe61601a3d1b5143da35c52140cd_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
- Size 688KB
- SHA256 7a68cf889617d8bea05f8a594c0d747cf5594aa3d7a5a0dc7332b9f1681f4505
- MD5 0c9efe61601a3d1b5143da35c52140cd
- SHA1 fda84b317297b437f7aeb9bc0fe8e0c8058e97f0
- SHA512 e71c8ace31d23024edc076eb72c40ced87bb8ea7a1a5f577e0943be9e4358f9c841dbf96c32a69301d9e8e3bf05382e6a1bf4b554b52279c5294cf67c2c4a598
- SSDEEP 6144:DdaBL6CRJTOvRuU9QXPB7vOUjBCEqOttJMJaJlJKJiJ+JpJaJGJgJ5J9JYJ4JYJ4:Dd8mCRY9QXAUjkENt/
- TLSH T1E7E46D9226F81CD6E58F1B3C19B145678DA0FA70443A663615C8E88F0DAFDE3467C7B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Windows security modification