2026-05-11_a3b72283683ddf87cdf31e001cd5073e_manuscrypt_redline-stealer_rhadamanthys_stealc_stop

General

Target
2026-05-11_a3b72283683ddf87cdf31e001cd5073e_manuscrypt_redline-stealer_rhadamanthys_stealc_stop
Size 13.0MB
Sample260511-b136qacy2q
SHA256 ca9335d5035f38e0a63b3a38735b538fa2bd1ab6a95c3975fbc56b3be089b4fa
MD5 a3b72283683ddf87cdf31e001cd5073e
SHA1 ccc5f1560ddda4d6bf8d27e88cd263e31eeab44d
SHA512 292ea6fb3da4d8f6aa3e9f189e2996594d565551fda73e135eff034bd85da487003f57b1376901cb0cef1f510e99231a08322063bcecc2e967de0485f371b543
SSDEEP 12288:5whXkDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDT:UX
TLSH
T172D64C5017F9444BE5FB6B3479F336A57963FCABF838878B3281440A1C6C4E1A64276B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_a3b72283683ddf87cdf31e001cd5073e_manuscrypt_redline-stealer_rhadamanthys_stealc_stop

File Explorer

2026-05-11_a3b72283683ddf87cdf31e001cd5073e_manuscrypt_redline-stealer_rhadamanthys_stealc_stop

.exe 13.0MB

2026-05-11_a3b72283683ddf87cdf31e001cd5073e_manuscrypt_redline-stealer_rhadamanthys_stealc_stop

IMPHASH 1a5a5aa2d8101b1942ff79e0ac371d65
SHA256 ca9335d5035f38e0a63b3a38735b538fa2bd1ab6a95c3975fbc56b3be089b4fa
MD5 a3b72283683ddf87cdf31e001cd5073e
SHA1 ccc5f1560ddda4d6bf8d27e88cd263e31eeab44d
SHA512 292ea6fb3da4d8f6aa3e9f189e2996594d565551fda73e135eff034bd85da487003f57b1376901cb0cef1f510e99231a08322063bcecc2e967de0485f371b543
SSDEEP 12288:5whXkDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDT:UX
TLSH
T172D64C5017F9444BE5FB6B3479F336A57963FCABF838878B3281440A1C6C4E1A64276B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10644

Magic Number

267

Subsystem

MAGE_SUBSYSTEM_UNKNOWN

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yicap\detimazayaruso\fakupofuzal.pdb

kernel32

IsBadStringPtrW lstrlenA DebugActiveProcessStop GlobalAddAtomA WriteTapemark GetSystemDefaultLCID GetCommProperties GetCommandLineA GlobalAlloc LoadLibraryW ReadFile FindNextVolumeMountPointW SetConsoleTitleA WritePrivateProfileStringW GetTempPathW GetLastError GetProcAddress OpenWaitableTimerA GetProcessWorkingSetSize WritePrivateProfileStringA SetCommMask OpenFileMappingA LCMapStringW FlushFileBuffers InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection DeleteFileA GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree RtlUnwind RaiseException TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CloseHandle

user32

SetCaretPos GetCaretPos

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_a3b72283683ddf87cdf31e001cd5073e_manuscrypt_redline-stealer_rhadamanthys_stealc_stop

kernel32

user32

generic