2026-07-14_f393c33ed92dbcebd8703f787558ffaf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_f393c33ed92dbcebd8703f787558ffaf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop
Size 645KB
Sample260715-acl2vsfw8p
SHA256 7c06d1ad9ccba51307d66166024a98855d6093684447ff563c50e7fd79ba40e4
MD5 f393c33ed92dbcebd8703f787558ffaf
SHA1 e61910a95320e0e72ae7525776869cba59442718
SHA512 09cffa780cb4c3de31fe5cfed7256c72a5720126c553c1b3bcb5082c2345b1c839c16eb8cdc7b289083934b8bd3c8a57cfca017e945e9d1c17ad3888e8c37ee7
SSDEEP 12288:0CieGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:0enQ/tbw/2Mkjy6Fr7g0op
TLSH
T1DFE422357690E473E82606745C55C6A29B3F1D916BB5D2CBBB88073F5EB43C00EBA386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_f393c33ed92dbcebd8703f787558ffaf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-14_f393c33ed92dbcebd8703f787558ffaf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 645KB

2026-07-14_f393c33ed92dbcebd8703f787558ffaf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH e7009d3ca42613ae2fdce5056be8a344
SHA256 7c06d1ad9ccba51307d66166024a98855d6093684447ff563c50e7fd79ba40e4
MD5 f393c33ed92dbcebd8703f787558ffaf
SHA1 e61910a95320e0e72ae7525776869cba59442718
SHA512 09cffa780cb4c3de31fe5cfed7256c72a5720126c553c1b3bcb5082c2345b1c839c16eb8cdc7b289083934b8bd3c8a57cfca017e945e9d1c17ad3888e8c37ee7
SSDEEP 12288:0CieGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:0enQ/tbw/2Mkjy6Fr7g0op
TLSH
T1DFE422357690E473E82606745C55C6A29B3F1D916BB5D2CBBB88073F5EB43C00EBA386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Webhost\16-09-2024\WindowsBuilds\DC_NATIVE\9093392\desktopcentral\ONPREMISE\SA_SRC\native\agent\Release\dcagentregister.pdb

kernel32

GetWindowsDirectoryA OpenProcess WideCharToMultiByte LoadLibraryW Sleep SizeofResource TerminateProcess MultiByteToWideChar Process32First GetLastError GetProcAddress LoadLibraryA Process32Next ProcessIdToSessionId LockResource GetModuleHandleA CreateToolhelp32Snapshot CloseHandle ReadFile SetEndOfFile GetCurrentProcess LoadResource FreeLibrary FindResourceW FindResourceExW GetCommandLineW SetFilePointer SetStdHandle FlushFileBuffers GetConsoleMode RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId IsProcessorFeaturePresent HeapCreate RtlUnwind ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW CreateFileW GetConsoleCP WriteConsoleW

user32

MessageBoxA

advapi32

RevertToSelf ImpersonateLoggedOnUser RegOpenKeyExA RegQueryValueExW OpenProcessToken RegCloseKey

shell32

CommandLineToArgvW

mpr

WNetGetUniversalNameA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_f393c33ed92dbcebd8703f787558ffaf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

mpr

generic