2026-07-05_08c4f5fe2a3f73a351af44f5f7ff28a4_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-07-05_08c4f5fe2a3f73a351af44f5f7ff28a4_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop
Size 87KB
Sample260705-kktrsaey9j
SHA256 ef2e6ef1224257707b6cc52ae28fa6e8df997bca36745eb95fd31f370f9740e0
MD5 08c4f5fe2a3f73a351af44f5f7ff28a4
SHA1 9202fd07800e53cf27d347797e277634cefed942
SHA512 6a1f4c875dc70a572d2c3a5795e9c5e6163a83f09bbd40dee31431995da7447807cad9473b04b86366b3434d2c8e9a01ffccaca63436b96c6ef69e42e87e4a9e
SSDEEP 1536:VCYF67LhF+9Wko1VSxb5kHTfCDwkhdKpiu2VS63T:UMQLhU9WVUA+Dh0p12VS6j
TLSH
T1DD938D127750C0B2C85659308DA9DBB29B7FBD3096B58487B7D8076B2FB07C09A39367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-05_08c4f5fe2a3f73a351af44f5f7ff28a4_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-05_08c4f5fe2a3f73a351af44f5f7ff28a4_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 87KB

2026-07-05_08c4f5fe2a3f73a351af44f5f7ff28a4_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 8ef1839b1d0a4926df9acea79827a4c5
SHA256 ef2e6ef1224257707b6cc52ae28fa6e8df997bca36745eb95fd31f370f9740e0
MD5 08c4f5fe2a3f73a351af44f5f7ff28a4
SHA1 9202fd07800e53cf27d347797e277634cefed942
SHA512 6a1f4c875dc70a572d2c3a5795e9c5e6163a83f09bbd40dee31431995da7447807cad9473b04b86366b3434d2c8e9a01ffccaca63436b96c6ef69e42e87e4a9e
SSDEEP 1536:VCYF67LhF+9Wko1VSxb5kHTfCDwkhdKpiu2VS63T:UMQLhU9WVUA+Dh0p12VS6j
TLSH
T1DD938D127750C0B2C85659308DA9DBB29B7FBD3096B58487B7D8076B2FB07C09A39367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c1:cc:3e:cc:32:13:d0:91:41:35:50:2c:23:3a:c9:4a:96:ff:4e:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Chains

Sep 10, 2015

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Serial Number

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 20, 2015 - Jun 18, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

18527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TeamCity\BuildAgent1\work\b1e8ba0c30aa9de6\Projects\ChromeExtAPI\Build.TT\Release.x86\t8barsvc.pdb

kernel32

GetCurrentThreadId CreateDirectoryA CopyFileA DeleteFileA MoveFileA GetLocalTime _lopen _lcreat _llseek _lwrite _lclose WaitForMultipleObjects VerifyVersionInfoW VerSetConditionMask CreateEventA CreateNamedPipeA GetCurrentThread GetModuleHandleW ResetEvent SetLastError ConnectNamedPipe ReadFile GetOverlappedResult WriteFile DisconnectNamedPipe SetEvent ExpandEnvironmentStringsA FreeResource LoadLibraryA FindResourceA LoadResource LockResource LeaveCriticalSection EnterCriticalSection FormatMessageA LocalFree FreeLibrary DeleteCriticalSection InitializeCriticalSection Sleep lstrcmpiA GetModuleFileNameA LoadLibraryExA LocalAlloc GetCommandLineA lstrcpyA lstrlenA lstrcpynA CloseHandle WaitForSingleObject GetLastError CreateProcessA GetProcAddress CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode EncodePointer DecodePointer ExitThread CreateThread HeapAlloc HeapFree HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize ExitProcess GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree WideCharToMultiByte LCMapStringW MultiByteToWideChar RtlUnwind IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc LoadLibraryW GetStringTypeW RaiseException SetFilePointer GetConsoleCP

user32

wsprintfA

advapi32

RegCreateKeyExA InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorA RegCloseKey RegSetValueExA RevertToSelf DuplicateTokenEx OpenThreadToken ImpersonateNamedPipeClient DeleteService ControlService OpenServiceA CloseServiceHandle QueryServiceStatus StartServiceA CreateServiceA OpenSCManagerA DeregisterEventSource ReportEventA RegisterEventSourceA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA

shlwapi

SHDeleteValueA SHDeleteKeyA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_08c4f5fe2a3f73a351af44f5f7ff28a4_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

kernel32

user32

advapi32

shlwapi

generic