2026-04-16_6dee6309efa7c244d8782cc6ad3d4817_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_6dee6309efa7c244d8782cc6ad3d4817_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
Size 11.4MB
Sample260416-vec7ysaw91
SHA256 c996a547894c83e2e118ce558f0b0df17779c49e6737a2598594e3e6f91b943c
MD5 6dee6309efa7c244d8782cc6ad3d4817
SHA1 bf4f40c14505a62fbbde1107dcd16db7e0e742c5
SHA512 4abaa8a52310a0ef693814ce14499a4146e6bc35f1527f7b9bc824ae973c08aa893db177e85231cfa3e1ab76bd13c077f545903af50363563bea87e8e8fa8263
SSDEEP 3072:uKPtaVfzJ+xzpxIUgpnvKxvGbqqV7gPCs5lQYFwGfABn/9vOsJp7tvFw3Lw3:fetWkUIy4bVyCs5ZQ/OI
TLSH
T1C6C6630981A90D83CEAAFD78768D0A1FCECD505FB04F770922D2F83AF566925DD1B621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_6dee6309efa7c244d8782cc6ad3d4817_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-04-16_6dee6309efa7c244d8782cc6ad3d4817_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

.exe 11.4MB

2026-04-16_6dee6309efa7c244d8782cc6ad3d4817_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH ec65e6f92ccc76ed34358795395fdcf8
SHA256 c996a547894c83e2e118ce558f0b0df17779c49e6737a2598594e3e6f91b943c
MD5 6dee6309efa7c244d8782cc6ad3d4817
SHA1 bf4f40c14505a62fbbde1107dcd16db7e0e742c5
SHA512 4abaa8a52310a0ef693814ce14499a4146e6bc35f1527f7b9bc824ae973c08aa893db177e85231cfa3e1ab76bd13c077f545903af50363563bea87e8e8fa8263
SSDEEP 3072:uKPtaVfzJ+xzpxIUgpnvKxvGbqqV7gPCs5lQYFwGfABn/9vOsJp7tvFw3Lw3:fetWkUIy4bVyCs5ZQ/OI
TLSH
T1C6C6630981A90D83CEAAFD78768D0A1FCECD505FB04F770922D2F83AF566925DD1B621
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GlobalFix SetDefaultCommConfigA EnumCalendarInfoA AllocConsole GetProfileIntW InterlockedIncrement InterlockedDecrement GetProfileSectionA SetComputerNameW GetSystemDefaultLCID GetTickCount GetSystemTimeAsFileTime GetConsoleTitleA ReadConsoleW TzSpecificLocalTimeToSystemTime GetDriveTypeA GlobalAlloc LoadLibraryW IsProcessInJob GetCalendarInfoW SetVolumeMountPointA GetConsoleAliasExesLengthW GetFileAttributesW WriteConsoleW SetSystemPowerState GetModuleFileNameW CreateFileW GetVolumePathNameA GetStringTypeExA GetPrivateProfileIntW ReleaseActCtx GetCurrentDirectoryW SetLastError GetProcAddress MoveFileW RemoveDirectoryA SearchPathA GetTempFileNameA SetFileApisToOEM LoadLibraryA SetCalendarInfoW FindFirstVolumeMountPointW BeginUpdateResourceA AddAtomA GlobalWire FindNextFileA CreateIoCompletionPort GetModuleHandleA lstrcatW FreeEnvironmentStringsW EnumDateFormatsW CompareStringA WaitForDebugEvent SetThreadAffinityMask FileTimeToLocalFileTime DeleteAtom MoveFileWithProgressW EnumSystemLocalesW DeleteFileA EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetModuleHandleW ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetLocaleInfoW WriteFile GetStdHandle GetModuleFileNameA GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle SetStdHandle

Name

.text

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

109KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

xuFmqcdU

Size

12KB

Virtual Size

12KB

Characteristics

Name

XHndIkBq

Size

2KB

Virtual Size

1KB

Characteristics

Name

EXgESjGa

Size

6KB

Virtual Size

5KB

Characteristics

Name

IKkdPcUP

Size

1KB

Virtual Size

1KB

Characteristics

Name

fMmFxETO

Size

4KB

Virtual Size

4KB

Characteristics

Name

dMmNBcYz

Size

1KB

Virtual Size

1KB

Characteristics

Name

ZfigNGfa

Size

3KB

Virtual Size

3KB

Characteristics

Name

XleDRCQZ

Size

2KB

Virtual Size

1KB

Characteristics

Name

dTMKAfOR

Size

24KB

Virtual Size

23KB

Characteristics

Name

fiQwEZtz

Size

2KB

Virtual Size

1KB

Characteristics

Name

MEgtMyot

Size

26KB

Virtual Size

25KB

Characteristics

Name

gzKquavG

Size

11.0MB

Virtual Size

788B

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_6dee6309efa7c244d8782cc6ad3d4817_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

kernel32

generic