2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop
Size 1.2MB
Sample260408-e1ed5sgy8k
SHA256 1f03dd4db5b7c81c32a77908f3ba149998509df8fe3f1780c269198ef045cfb0
MD5 c26055270f3c727d018e1848ab6d16f0
SHA1 02b7ee6c2f37ab07a4d1ce601581b1ca958e10ad
SHA512 4cf1cb927a0fd4458803055008f00be21f5313e9cb322cdacab78661fce9a1ec247b6b30e617edea747081225f7b7cfbe1e88d71d7f8b2e60ff8437908f0042a
SSDEEP 24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1oIxvOJFIw4W/:YuosfYWH6zuKd6z3xvOJFIw4q
TLSH
T18445BF0336947CE2C7255B706E5DA9DA7329B8637F41AB962500674F0CBB2E8DF47B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop

File Explorer

2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop

.exe 1.2MB

2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop

IMPHASH deee2f3ec985195fc99175dfed532c7c
SHA256 1f03dd4db5b7c81c32a77908f3ba149998509df8fe3f1780c269198ef045cfb0
MD5 c26055270f3c727d018e1848ab6d16f0
SHA1 02b7ee6c2f37ab07a4d1ce601581b1ca958e10ad
SHA512 4cf1cb927a0fd4458803055008f00be21f5313e9cb322cdacab78661fce9a1ec247b6b30e617edea747081225f7b7cfbe1e88d71d7f8b2e60ff8437908f0042a
SSDEEP 24576:3IwoFmXsR3sf1viW1V6T/uKWZUtH6z1oIxvOJFIw4W/:YuosfYWH6zuKd6z3xvOJFIw4q
TLSH
T18445BF0336947CE2C7255B706E5DA9DA7329B8637F41AB962500674F0CBB2E8DF47B20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15735

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalCompact GetUserDefaultLCID AddConsoleAliasW CreateHardLinkA GetTickCount GetWindowsDirectoryA EnumTimeFormatsW FindResourceExA GetVolumeInformationA LoadLibraryW ReadConsoleInputA CopyFileW WriteConsoleW GetCompressedFileSizeA GetTempPathW SetThreadLocale GetLastError SetLastError GetProcAddress GetLocaleInfoA CreateTimerQueueTimer SetStdHandle SetFileAttributesA WriteConsoleA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW GetExitCodeThread RemoveDirectoryW AddAtomA GlobalFindAtomW GetModuleFileNameA GetOEMCP GlobalUnWire LoadLibraryExA AddConsoleAliasA OutputDebugStringW GetComputerNameA FindFirstChangeNotificationW GetSystemDefaultLangID FlushFileBuffers GetConsoleMode HeapFree EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsValidCodePage GetACP GetCPInfo GetCurrentThreadId IsDebuggerPresent GetProcessHeap ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapSize EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle HeapAlloc WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetStringTypeW LoadLibraryExW HeapReAlloc ReadFile SetFilePointerEx LCMapStringW GetConsoleCP CreateFileW

user32

GetMenuItemID

gdi32

GetCharacterPlacementW

advapi32

DeregisterEventSource

winhttp

WinHttpConnect

Name

.text

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

741KB

Virtual Size

22.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

RAbFuUqf

Size

6KB

Virtual Size

5KB

Characteristics

Name

wehwSbww

Size

512B

Virtual Size

470B

Characteristics

Name

dbrVcqRR

Size

33KB

Virtual Size

33KB

Characteristics

Name

LSXsRWnW

Size

512B

Virtual Size

397B

Characteristics

Name

shCjwpVl

Size

9KB

Virtual Size

9KB

Characteristics

Name

vFohRyyD

Size

1024B

Virtual Size

545B

Characteristics

Name

yhwsxNZO

Size

13KB

Virtual Size

12KB

Characteristics

Name

mVIIdvGJ

Size

1024B

Virtual Size

992B

Characteristics

Name

hQeHrKtw

Size

14KB

Virtual Size

13KB

Characteristics

Name

QUEzLuVQ

Size

4KB

Virtual Size

3KB

Characteristics

Name

XyJwcOvo

Size

17KB

Virtual Size

17KB

Characteristics

Name

zcWAIrXZ

Size

2KB

Virtual Size

1KB

Characteristics

Name

LleWhzos

Size

512B

Virtual Size

212B

Characteristics

Name

OgBOLsIb

Size

1024B

Virtual Size

764B

Characteristics

Name

qgidaqBH

Size

22KB

Virtual Size

22KB

Characteristics

Name

QXLsZevE

Size

3KB

Virtual Size

2KB

Characteristics

Name

WxZqDZUN

Size

4KB

Virtual Size

3KB

Characteristics

Name

srHvxieP

Size

1KB

Virtual Size

1KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-08_c26055270f3c727d018e1848ab6d16f0_elex_manuscrypt_maze_njrat_rhadamanthys_stop

kernel32

user32

gdi32

advapi32

winhttp

generic