2026-07-18_af19aea3ad9aa69a2efddc5557003023_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-07-18_af19aea3ad9aa69a2efddc5557003023_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 488KB
Sample260718-hfe2qaa13p
SHA256 250638a93c54994a1a3ac00c9294f6990efa0d9ed69580b0fb475fa74cd1cd5a
MD5 af19aea3ad9aa69a2efddc5557003023
SHA1 809ae77de789838d6f5c4635829d525e2a5c3a96
SHA512 9867bdb2ee57081eaf0d49d950128ca3c9699a952050638a58b12b8729b0024437a247c78fa5789f331ed05a4d9b9831100d2efbef1ff9bd829d330e05e368b6
SSDEEP 12288:w2RI+wfRaSDkBCU1E2kSGkQ3BaqWgVvvW1l:ZRI+whksU6cS3BRWEsl
TLSH
T1A2B46C74E21364ECD01ADE3B37DCBDF099942A602F16539369EE355802B8E9683785CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_af19aea3ad9aa69a2efddc5557003023_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-18_af19aea3ad9aa69a2efddc5557003023_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 488KB

2026-07-18_af19aea3ad9aa69a2efddc5557003023_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 5e34b111d5ca30f53910975361e811e1
SHA256 250638a93c54994a1a3ac00c9294f6990efa0d9ed69580b0fb475fa74cd1cd5a
MD5 af19aea3ad9aa69a2efddc5557003023
SHA1 809ae77de789838d6f5c4635829d525e2a5c3a96
SHA512 9867bdb2ee57081eaf0d49d950128ca3c9699a952050638a58b12b8729b0024437a247c78fa5789f331ed05a4d9b9831100d2efbef1ff9bd829d330e05e368b6
SSDEEP 12288:w2RI+wfRaSDkBCU1E2kSGkQ3BaqWgVvvW1l:ZRI+whksU6cS3BRWEsl
TLSH
T1A2B46C74E21364ECD01ADE3B37DCBDF099942A602F16539369EE355802B8E9683785CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress LoadLibraryW FreeLibrary FlushFileBuffers CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile CreateFileA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_af19aea3ad9aa69a2efddc5557003023_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic