2026-07-17_681c0f0aff8d0d870a27260876896b0c_amadey_elex_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_681c0f0aff8d0d870a27260876896b0c_amadey_elex_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop
Size 2.1MB
Sample260718-d3dpysez2n
SHA256 393b2fd6da39b4d966e72152e69578c4fda1b2133c707d8d5ebb4de4770f815c
MD5 681c0f0aff8d0d870a27260876896b0c
SHA1 7a0da45d9acc6629dc1ba579cd062e17cb396519
SHA512 874086c6df18f38c44bd6583b7ccdbcdb7466401f954300d731f737c2fdc3c93138eba4a7e53602a96b1798795fe19482b9a950d95d486f00274368b936774b2
SSDEEP 49152:2zWkSCEHLdN6muuZJeyT0JmYMYEXTrQ1faKFYFvgkcOypyXM:2KkSzHRQmuufeyT0JmYlEXT0tF6vgkta
TLSH
T1EAA52309B2D19136E622073044F18AA1EFBEB9752934E527F38D049D0BB1BA2F5197F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-17_681c0f0aff8d0d870a27260876896b0c_amadey_elex_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 2.1MB

2026-07-17_681c0f0aff8d0d870a27260876896b0c_amadey_elex_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 60f2858f8c859062bd16000a4cb2a2ed
SHA256 393b2fd6da39b4d966e72152e69578c4fda1b2133c707d8d5ebb4de4770f815c
MD5 681c0f0aff8d0d870a27260876896b0c
SHA1 7a0da45d9acc6629dc1ba579cd062e17cb396519
SHA512 874086c6df18f38c44bd6583b7ccdbcdb7466401f954300d731f737c2fdc3c93138eba4a7e53602a96b1798795fe19482b9a950d95d486f00274368b936774b2
SSDEEP 49152:2zWkSCEHLdN6muuZJeyT0JmYMYEXTrQ1faKFYFvgkcOypyXM:2KkSzHRQmuufeyT0JmYlEXT0tF6vgkta
TLSH
T1EAA52309B2D19136E622073044F18AA1EFBEB9752934E527F38D049D0BB1BA2F5197F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

4b:af:ee:c4:2f:08:60:66:0e:c5:3b:e2:11:22:1b:04:5a:f1:31:92:e9:70:c9:e8:f6:cb:38:d6:5b:fd:4c:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Allround Automations V.O.F.,O=Allround Automations V.O.F.,L=Enschede,ST=Overijssel,C=NL

Chains

Jun 17, 2022

CN=Allround Automations V.O.F.,O=Allround Automations V.O.F.,L=Enschede,ST=Overijssel,C=NL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Allround Automations V.O.F.,O=Allround Automations V.O.F.,L=Enschede,ST=Overijssel,C=NL

Serial Number

28:1b:cf:99:c1:cb:16:f0:dc:be:2b:1c:e1:d6:45:40

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2019 - Dec 6, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

Major OS version

Entry point

44830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteExA SHGetMalloc

user32

BeginPaint GetSysColor GetClientRect SetRect EndPaint LoadCursorA GetLastActivePopup ShowWindow PostMessageA SendMessageA EnableWindow GetTopWindow SetWindowLongA GetWindowLongA SetWindowTextA SetForegroundWindow SetActiveWindow SetDlgItemTextA CharUpperBuffA LoadIconA SetWindowWord SendDlgItemMessageA GetDlgItem InvalidateRect UpdateWindow LoadStringA MessageBoxA SetTimer GetMessageA KillTimer PostQuitMessage DialogBoxParamA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos PeekMessageA TranslateMessage DispatchMessageA SetCursor CharNextA GetWindowWord DefWindowProcA RegisterClassA GetParent

kernel32

GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapDestroy VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize Sleep GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetVersionExA FindClose FindFirstFileA SetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA GetEnvironmentVariableA DeleteFileA SetFileAttributesA GetConsoleMode SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject SetErrorMode GetLocalTime lstrlenA CreateFileW ReadFile LoadLibraryA InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers RemoveDirectoryA MultiByteToWideChar RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_681c0f0aff8d0d870a27260876896b0c_amadey_elex_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop

shell32

user32

kernel32

gdi32

comctl32

generic