2026-07-20_9a36524db277747e34c7118aaa4e698c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_9a36524db277747e34c7118aaa4e698c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 1.5MB
Sample260720-s434kagy2x
SHA256 b191dbd74f95f8bb05bf125b4a6808cee918974451a9071a72ea2de71cca3b6e
MD5 9a36524db277747e34c7118aaa4e698c
SHA1 625dd8f3ef000b0ca302a39647883313a9432ce0
SHA512 832e1fb5dc0ea454765a569395127390b717ffbf3dedcf98b9c07b087b0e4c79f5946490099ce861c6be3247cfa9aeba7ead4fa1a89781d22b6277017d54266c
SSDEEP 12288:5XW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7T:pWyxknw4FYnshx8OfVe247
TLSH
T19575F12072418071F75A0B324966FAD44629AD385BE4E1DFE3B8BE3EA9714D3693710F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_9a36524db277747e34c7118aaa4e698c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-20_9a36524db277747e34c7118aaa4e698c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 1.5MB

2026-07-20_9a36524db277747e34c7118aaa4e698c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH e31f181a524f70aded78954111d5977e
SHA256 b191dbd74f95f8bb05bf125b4a6808cee918974451a9071a72ea2de71cca3b6e
MD5 9a36524db277747e34c7118aaa4e698c
SHA1 625dd8f3ef000b0ca302a39647883313a9432ce0
SHA512 832e1fb5dc0ea454765a569395127390b717ffbf3dedcf98b9c07b087b0e4c79f5946490099ce861c6be3247cfa9aeba7ead4fa1a89781d22b6277017d54266c
SSDEEP 12288:5XW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7T:pWyxknw4FYnshx8OfVe247
TLSH
T19575F12072418071F75A0B324966FAD44629AD385BE4E1DFE3B8BE3EA9714D3693710F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28546

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\EPM\_EPM_main\SetupUE\Release\SetupUE.pdb

kernel32

GetProcAddress LoadLibraryA GetVersionExW GetTimeZoneInformation CloseHandle WaitForSingleObject FreeLibrary LocalFree GetModuleFileNameW GetCommandLineW GetModuleHandleW GetSystemInfo CreateProcessW GetLocaleInfoW FlushFileBuffers CreateFileA GetLocaleInfoA RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep VirtualAlloc HeapReAlloc HeapSize InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetSystemMetrics

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyW

shell32

CommandLineToArgvW

netapi32

NetApiBufferFree NetWkstaGetInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_9a36524db277747e34c7118aaa4e698c_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

netapi32

generic