2026-06-04_b12c65f36ec48238db73aab2f19a3121_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_b12c65f36ec48238db73aab2f19a3121_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 12.5MB
Sample260604-tsb2dabt8j
SHA256 377ce24eb21e103371c28c9c76bd1e7ef23eeebb954879616b22e15c8a563c3d
MD5 b12c65f36ec48238db73aab2f19a3121
SHA1 14f9b639fba486a258e70312dad95c95336f72bb
SHA512 b331f3d049c6e340522403f1f6dee4ce2bb28c1093bc7d766546726822d7b74dcc8ff247ad57725cae0925d056b90e3d248cab09ab71f4c7f2854a161b08df66
SSDEEP 393216:7zxQt2PiGfJKQRAuGl14nwqQxdI8+40u/f49Ul:7dQcit8A71qwqQxd3+Y/f
TLSH
T1CCD63349E2C180F0F2E3D67104ECB2EA7BA3E8A56D3ACDD233E1590E1E75A59451B770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-04_b12c65f36ec48238db73aab2f19a3121_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 12.5MB

2026-06-04_b12c65f36ec48238db73aab2f19a3121_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH cc000e0a56358759c95f653af1246259
SHA256 377ce24eb21e103371c28c9c76bd1e7ef23eeebb954879616b22e15c8a563c3d
MD5 b12c65f36ec48238db73aab2f19a3121
SHA1 14f9b639fba486a258e70312dad95c95336f72bb
SHA512 b331f3d049c6e340522403f1f6dee4ce2bb28c1093bc7d766546726822d7b74dcc8ff247ad57725cae0925d056b90e3d248cab09ab71f4c7f2854a161b08df66
SSDEEP 393216:7zxQt2PiGfJKQRAuGl14nwqQxdI8+40u/f49Ul:7dQcit8A71qwqQxd3+Y/f
TLSH
T1CCD63349E2C180F0F2E3D67104ECB2EA7BA3E8A56D3ACDD233E1590E1E75A59451B770
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

2d:6d:b4:8d:e4:65:ff:41:81:9e:3c:6a:f6:53:eb:ff:af:32:71:5e:e6:18:54:29:8b:42:c4:e3:97:04:74:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3154807,CN=Prolink Software Corporation,O=Prolink Software Corporation,ST=Connecticut,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130b436f6e6e65637469637574,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 8, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

4d:f4:de:eb:97:a4:7c:d4:40:9a:b7:58:d5:c9:1c:0a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2025 - Oct 19, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

52628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA RemoveDirectoryA SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA DeleteFileA GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject GetLongPathNameA GetTempPathA GetCommandLineA CopyFileA GetFileAttributesA LoadLibraryExA GetSystemDirectoryA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetEnvironmentVariableA GetDriveTypeA LocalAlloc DosDateTimeToFileTime LocalFileTimeToFileTime GetVersionExA SetFileTime CreateDirectoryA SetCurrentDirectoryA FindFirstFileA FindClose GetLastError GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree HeapReAlloc GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep HeapSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers

gdi32

CreateDCA SetBkColor SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_b12c65f36ec48238db73aab2f19a3121_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

gdi32

generic