2026-06-25_05ff454336949967b9a97591a06d03f8_elex_karagany_manuscrypt_rhadamanthys_stop

General

Target
2026-06-25_05ff454336949967b9a97591a06d03f8_elex_karagany_manuscrypt_rhadamanthys_stop
Size 125KB
Sample260630-aptbpsbz3m
SHA256 896e6efd7ee957a96df2063acdc3a927155d439424d88f9f79b531d535cc27d0
MD5 05ff454336949967b9a97591a06d03f8
SHA1 6bdd2e0cc28f377eba434990b9357095574d5b48
SHA512 3b3dfaa966babc6b7c12c4d45b5fb2ca8ae5c30c62bc3665123b8ae3c0b7e6dfd6ba2be51017e9d21d0d7aa3d61979a9907bdd8478534298ea59c8d83a147298
SSDEEP 3072:qgt9kGLVrJyB/RuaEZIsMsfKD7d76tIyBw2LU+:dkGLVQB/RbsTE16tVFQ
TLSH
T1D0C38D2172D1C072C59215309878EBF15E7EF8325B75A187B3D81A7A2F603C19B397AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-25_05ff454336949967b9a97591a06d03f8_elex_karagany_manuscrypt_rhadamanthys_stop

File Explorer

2026-06-25_05ff454336949967b9a97591a06d03f8_elex_karagany_manuscrypt_rhadamanthys_stop

.exe 125KB

2026-06-25_05ff454336949967b9a97591a06d03f8_elex_karagany_manuscrypt_rhadamanthys_stop

IMPHASH 60150404ae0a9f724ed24d81b7766604
SHA256 896e6efd7ee957a96df2063acdc3a927155d439424d88f9f79b531d535cc27d0
MD5 05ff454336949967b9a97591a06d03f8
SHA1 6bdd2e0cc28f377eba434990b9357095574d5b48
SHA512 3b3dfaa966babc6b7c12c4d45b5fb2ca8ae5c30c62bc3665123b8ae3c0b7e6dfd6ba2be51017e9d21d0d7aa3d61979a9907bdd8478534298ea59c8d83a147298
SSDEEP 3072:qgt9kGLVrJyB/RuaEZIsMsfKD7d76tIyBw2LU+:dkGLVQB/RbsTE16tVFQ
TLSH
T1D0C38D2172D1C072C59215309878EBF15E7EF8325B75A187B3D81A7A2F603C19B397AB
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\AutoBuild\src\NET110\1093_1480\target\release\symbols\server\BmpLoader.pdb

kernel32

WriteFile CreateFileA GetModuleFileNameA GetExitCodeProcess WaitForSingleObject CreateProcessA GetCommandLineA WideCharToMultiByte HeapFree HeapAlloc GetProcessHeap ReleaseMutex OpenMutexA CreateDirectoryA RemoveDirectoryA DeleteFileA WritePrivateProfileStringA GetVersionExA SetFilePointer SetEndOfFile ReadFile FlushFileBuffers OpenEventA FreeLibrary LoadLibraryA GetLocalTime GetTempPathA GetTickCount GetDriveTypeA GetWindowsDirectoryA SetUnhandledExceptionFilter SetErrorMode InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CompareStringW CreateFileW GetStringTypeW GetDriveTypeW LoadLibraryW HeapReAlloc WriteConsoleW SetStdHandle LCMapStringW IsValidCodePage GetOEMCP GetACP SetEnvironmentVariableA GetCurrentProcess CreateToolhelp32Snapshot Process32First Process32Next OpenProcess CreateMutexA GetCurrentThreadId GetSystemDirectoryA CreateEventA SetEvent MoveFileExA GetFileAttributesA SetFileAttributesA Sleep FindNextFileA FindFirstFileA FindClose GetLastError LocalFree GetModuleHandleA GetProcAddress TerminateProcess UnmapViewOfFile CloseHandle CreateFileMappingA MapViewOfFile GetCurrentProcessId FlushViewOfFile GetCPInfo GetTimeZoneInformation GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetFullPathNameA QueryPerformanceCounter HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetFileType GetStdHandle SetHandleCount ExitProcess HeapSize MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime RaiseException HeapSetInformation GetStartupInfoW FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError InterlockedDecrement UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent

user32

GetMessageA PostThreadMessageA

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA RegCloseKey SetFileSecurityA ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

SHGetFolderPathA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-25_05ff454336949967b9a97591a06d03f8_elex_karagany_manuscrypt_rhadamanthys_stop

kernel32

user32

advapi32

shell32

generic