2026-06-04_5c769330000d6db47100069511fc4ed6_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_5c769330000d6db47100069511fc4ed6_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 14.9MB
Sample260604-th5kyaa18q
SHA256 45df2a76b04a41dadef560a14dfbe3c33232fd02a759f24094b0784eb9635911
MD5 5c769330000d6db47100069511fc4ed6
SHA1 f9263b7f24679086c9d76cb758d2d21bdec1fca5
SHA512 0169f8f6ceb99aefcb2b8e65feb8eaa9e5fb76ab9e31519002c2929c4a0e5f74587f4dba906eb0f11de25a8f3018e5a6098cf9cf238c9355400725ad2a1507d8
SSDEEP 393216:GSyilWw8z0Md8e1+YGFNUVa2PkkdEpUogNmjejSgu8sSI:3lWw8z0gmfjMMUdmqpu3SI
TLSH
T17BF63307E6E7E196FC193CB04C34B5034E597E74C5308BE762B6705826F6283CA5BA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-04_5c769330000d6db47100069511fc4ed6_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 14.9MB

2026-06-04_5c769330000d6db47100069511fc4ed6_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH f2f9102c7663962c22d17a8dabc5e7ce
SHA256 45df2a76b04a41dadef560a14dfbe3c33232fd02a759f24094b0784eb9635911
MD5 5c769330000d6db47100069511fc4ed6
SHA1 f9263b7f24679086c9d76cb758d2d21bdec1fca5
SHA512 0169f8f6ceb99aefcb2b8e65feb8eaa9e5fb76ab9e31519002c2929c4a0e5f74587f4dba906eb0f11de25a8f3018e5a6098cf9cf238c9355400725ad2a1507d8
SSDEEP 393216:GSyilWw8z0Md8e1+YGFNUVa2PkkdEpUogNmjejSgu8sSI:3lWw8z0gmfjMMUdmqpu3SI
TLSH
T17BF63307E6E7E196FC193CB04C34B5034E597E74C5308BE762B6705826F6283CA5BA9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

85:db:c2:59:d2:c8:11:20:43:30:66:95:e9:11:17:14:39:a7:b9:fb:47:3b:7b:c0:dd:84:84:cb:f3:02:fe:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Medi-Dose\, Inc.,O=Medi-Dose\, Inc.,L=Warminster,ST=Pennsylvania,C=US

Chains

Apr 29, 2026

CN=Medi-Dose\, Inc.,O=Medi-Dose\, Inc.,L=Warminster,ST=Pennsylvania,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Medi-Dose\, Inc.,O=Medi-Dose\, Inc.,L=Warminster,ST=Pennsylvania,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Medi-Dose\, Inc.,O=Medi-Dose\, Inc.,L=Warminster,ST=Pennsylvania,C=US

Serial Number

07:83:91:ec:61:30:ec:75:40:cb:bc:05:60:40:04:ab

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 11, 2025 - Sep 10, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

42910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA FindExecutableA SHBrowseForFolderA SHGetMalloc

user32

GetClientRect SetRect EndPaint LoadCursorA GetLastActivePopup KillTimer ShowWindow PostMessageA SendMessageA EnableWindow SetTimer SetWindowTextA SetForegroundWindow SetActiveWindow SetDlgItemTextA GetKeyState CharUpperBuffA PeekMessageA GetSysColor DispatchMessageA GetParent SendDlgItemMessageA GetDlgItem InvalidateRect UpdateWindow LoadStringA MessageBoxA DialogBoxParamA GetWindowLongA SetWindowLongA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos SetCursor CharNextA BeginPaint SetWindowWord GetWindowWord DefWindowProcA RegisterClassA TranslateMessage

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapDestroy VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize Sleep GetCurrentThreadId SetLastError TlsFree TlsSetValue GetVersionExA FindClose FindFirstFileA GetCurrentDirectoryA SetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA GetEnvironmentVariableA SetFilePointer CreateFileA GetWindowsDirectoryA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA WideCharToMultiByte CreateProcessA lstrcmpiA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers WriteConsoleW CloseHandle RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor

advapi32

RegQueryValueA

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_5c769330000d6db47100069511fc4ed6_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

shell32

user32

kernel32

gdi32

advapi32

comctl32

generic