2026-07-18_ba042d75f5de79ec0d694ee0a082a6a3_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-07-18_ba042d75f5de79ec0d694ee0a082a6a3_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 488KB
Sample260718-ha37cset6w
SHA256 4f55e686c9d4cf9b2d0ff3fbf807ff32d2fdec73c7a7df8a174af9564e74bb66
MD5 ba042d75f5de79ec0d694ee0a082a6a3
SHA1 22566dd52344aa53378336a42008aae269c9323c
SHA512 1199892665533c8e49ebf62ede75beca1166467b319f582c94fce1cdfb977d08a343156486177f11a1feda214c77c76651fef8b4cdd963ac66480d615094013f
SSDEEP 6144:9eK2vZjZV+WDsPjfrhx4dBU87GW9cweVSh13yBCJMx2mbB+qjU8zecAa35zZnyLb:Z2BjZ9sPjfVcU8akFthcqbqKmp9n
TLSH
T1F4B49D83B27575D0FFA421F31E62BB44B13A4BA0DF749A856D89783E09B46C1EC18CD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_ba042d75f5de79ec0d694ee0a082a6a3_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-18_ba042d75f5de79ec0d694ee0a082a6a3_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 488KB

2026-07-18_ba042d75f5de79ec0d694ee0a082a6a3_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 5e34b111d5ca30f53910975361e811e1
SHA256 4f55e686c9d4cf9b2d0ff3fbf807ff32d2fdec73c7a7df8a174af9564e74bb66
MD5 ba042d75f5de79ec0d694ee0a082a6a3
SHA1 22566dd52344aa53378336a42008aae269c9323c
SHA512 1199892665533c8e49ebf62ede75beca1166467b319f582c94fce1cdfb977d08a343156486177f11a1feda214c77c76651fef8b4cdd963ac66480d615094013f
SSDEEP 6144:9eK2vZjZV+WDsPjfrhx4dBU87GW9cweVSh13yBCJMx2mbB+qjU8zecAa35zZnyLb:Z2BjZ9sPjfVcU8akFthcqbqKmp9n
TLSH
T1F4B49D83B27575D0FFA421F31E62BB44B13A4BA0DF749A856D89783E09B46C1EC18CD9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress LoadLibraryW FreeLibrary FlushFileBuffers CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile CreateFileA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_ba042d75f5de79ec0d694ee0a082a6a3_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic