2026-07-05_bad805156562155ab35fea5ddb9fc95c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-07-05_bad805156562155ab35fea5ddb9fc95c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
Size 226KB
Sample260705-blmv7abw7k
SHA256 3c57bbc6927516a93fd89c7d21ae08b457ece7cb50a15af8b9495931d26795a4
MD5 bad805156562155ab35fea5ddb9fc95c
SHA1 3ff77fb6d28d0bdad1ee22f8a9f17d18c5bfd7a0
SHA512 92f66aeb85c94dcc25f37635c40a834f124080cf7cb55ee638b288db4b2fd24ea2ab10d16cc6e94c34c3acb365e8011c5dc863f91518165a938866a5745aa450
SSDEEP 3072:hsXs2DPuNqiG8wryy2gDkc5DBNOIXOz0iDDL7LfUgTxGwo:hsXs05zkKpOz0ePzUcO
TLSH
T1A7348D01B8C38CF1E06F11B9C9D597B54ABBA937076114DB2FD45A6E8F283E2D630399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_bad805156562155ab35fea5ddb9fc95c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-07-05_bad805156562155ab35fea5ddb9fc95c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

.exe 226KB

2026-07-05_bad805156562155ab35fea5ddb9fc95c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

SHA256 3c57bbc6927516a93fd89c7d21ae08b457ece7cb50a15af8b9495931d26795a4
MD5 bad805156562155ab35fea5ddb9fc95c
SHA1 3ff77fb6d28d0bdad1ee22f8a9f17d18c5bfd7a0
SHA512 92f66aeb85c94dcc25f37635c40a834f124080cf7cb55ee638b288db4b2fd24ea2ab10d16cc6e94c34c3acb365e8011c5dc863f91518165a938866a5745aa450
SSDEEP 3072:hsXs2DPuNqiG8wryy2gDkc5DBNOIXOz0iDDL7LfUgTxGwo:hsXs05zkKpOz0ePzUcO
TLSH
T1A7348D01B8C38CF1E06F11B9C9D597B54ABBA937076114DB2FD45A6E8F283E2D630399
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.version

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.version

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_bad805156562155ab35fea5ddb9fc95c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee

generic