2026-05-06_c62cda299e5793bc9fc977abb7cb75d7_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_c62cda299e5793bc9fc977abb7cb75d7_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 11.8MB
Sample260506-pegmgsdz3n
SHA256 7cf07b9340ce9854b756770ab6da5ee7de265e2705aef65932b8cdcb8875e887
MD5 c62cda299e5793bc9fc977abb7cb75d7
SHA1 43ee95453f23463b5b9853bd2ce1150ee1550114
SHA512 d7511fc52989831bda1036f19fc2038ceff118684a503115ff5e34d07acfdbbad8b0e191582291e949fa0dd643ac3eb1dc80b39fd82dbfa60cd9ad9a0644ad99
SSDEEP 6144:6b/qTWJpjKTI1rFeB4jsVSfnLqS5ICk1hcGPsAza:CxJtKTIpEBc6fP
TLSH
T1DCC6950442F60D47DE6AFE74766E0A1FCEEE6417605EA31D21A1F42DA972E21CD23732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_c62cda299e5793bc9fc977abb7cb75d7_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-05-06_c62cda299e5793bc9fc977abb7cb75d7_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 11.8MB

2026-05-06_c62cda299e5793bc9fc977abb7cb75d7_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH b2d1ddaa0fa3f4815785888ef0186a05
SHA256 7cf07b9340ce9854b756770ab6da5ee7de265e2705aef65932b8cdcb8875e887
MD5 c62cda299e5793bc9fc977abb7cb75d7
SHA1 43ee95453f23463b5b9853bd2ce1150ee1550114
SHA512 d7511fc52989831bda1036f19fc2038ceff118684a503115ff5e34d07acfdbbad8b0e191582291e949fa0dd643ac3eb1dc80b39fd82dbfa60cd9ad9a0644ad99
SSDEEP 6144:6b/qTWJpjKTI1rFeB4jsVSfnLqS5ICk1hcGPsAza:CxJtKTIpEBc6fP
TLSH
T1DCC6950442F60D47DE6AFE74766E0A1FCEEE6417605EA31D21A1F42DA972E21CD23732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameA CreateFileA SetDefaultCommConfigA FindFirstFileW SetLocaleInfoA WriteConsoleInputW HeapAlloc UpdateResourceA VerSetConditionMask InterlockedDecrement GetProfileSectionA OutputDebugStringW ReadConsoleW WriteFile GetCommandLineA GlobalAlloc TerminateThread GetLocaleInfoW ReadConsoleInputA SetConsoleCP GlobalFlags WriteConsoleW CreateActCtxA FindNextVolumeMountPointW GetStartupInfoW CreateJobObjectA GetNamedPipeHandleStateW GetCPInfoExW GetLastError GetProcAddress HeapSize IsValidCodePage VerLanguageNameW LoadLibraryA UnhandledExceptionFilter OpenWaitableTimerW GetConsoleScreenBufferInfo IsWow64Process BuildCommDCBAndTimeoutsW GetNumberFormatW GetModuleHandleA OpenFileMappingW SetProcessShutdownParameters LocalSize GetWindowsDirectoryW ExpandEnvironmentStringsW CloseHandle SetStdHandle FlushFileBuffers WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetCommandLineW HeapSetInformation GetCPInfo RaiseException RtlUnwind LCMapStringW IsProcessorFeaturePresent GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate ExitProcess GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode CreateFileW

user32

CharToOemBuffW CharUpperW

Name

.text

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mex

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

gJEEvZZv

Size

3KB

Virtual Size

2KB

Characteristics

Name

hEhSFBct

Size

512B

Virtual Size

201B

Characteristics

Name

SPauDYJV

Size

1KB

Virtual Size

1KB

Characteristics

Name

SFEfdIzY

Size

2KB

Virtual Size

2KB

Characteristics

Name

dKXcAfqm

Size

31KB

Virtual Size

30KB

Characteristics

Name

UulhlZSx

Size

2KB

Virtual Size

1KB

Characteristics

Name

klLoiioq

Size

40KB

Virtual Size

39KB

Characteristics

Name

FYtjVNrn

Size

4KB

Virtual Size

3KB

Characteristics

Name

DedWPTso

Size

13KB

Virtual Size

13KB

Characteristics

Name

DOtJnyeB

Size

11.4MB

Virtual Size

1KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_c62cda299e5793bc9fc977abb7cb75d7_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

user32

generic