2026-07-22_218561da1c8f6b975d088e8ac4976795_elex_manuscrypt_phorpiex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_218561da1c8f6b975d088e8ac4976795_elex_manuscrypt_phorpiex_rhadamanthys_stop
Size 112KB
Sample260723-alfansbm2x
SHA256 dab034d5e6609eee42d40f4d61a0b95aa9dc4765c15d3d3dff81a2a16d7315bd
MD5 218561da1c8f6b975d088e8ac4976795
SHA1 65ecb0ec3954700dc5a7f9759996032e08c653e5
SHA512 a7551d3a657b9bebe411acbcda716633a92130031734d69d0933b96148fa3e4a03903737029bbbf2d52e2c20400d4604cbf88277d2c75df5ceb722d56b8c80da
SSDEEP 1536:q3L/ED9LEo5D+ZPJ4m6G+zZTATLu3dKVI7IYM5XDd4i5cAOy:oL/cl5Mi9G+zhWLqwZ5Xei5cAOy
TLSH
T18FB38D2034C1C432E567217988EAC7B58A6DF8310F7566D7BFC406AE4F276D29A36387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_218561da1c8f6b975d088e8ac4976795_elex_manuscrypt_phorpiex_rhadamanthys_stop

File Explorer

2026-07-22_218561da1c8f6b975d088e8ac4976795_elex_manuscrypt_phorpiex_rhadamanthys_stop

.exe 112KB

2026-07-22_218561da1c8f6b975d088e8ac4976795_elex_manuscrypt_phorpiex_rhadamanthys_stop

IMPHASH cf1136126b3340920376499ac9490ff7
SHA256 dab034d5e6609eee42d40f4d61a0b95aa9dc4765c15d3d3dff81a2a16d7315bd
MD5 218561da1c8f6b975d088e8ac4976795
SHA1 65ecb0ec3954700dc5a7f9759996032e08c653e5
SHA512 a7551d3a657b9bebe411acbcda716633a92130031734d69d0933b96148fa3e4a03903737029bbbf2d52e2c20400d4604cbf88277d2c75df5ceb722d56b8c80da
SSDEEP 1536:q3L/ED9LEo5D+ZPJ4m6G+zZTATLu3dKVI7IYM5XDd4i5cAOy:oL/cl5Mi9G+zhWLqwZ5Xei5cAOy
TLSH
T18FB38D2034C1C432E567217988EAC7B58A6DF8310F7566D7BFC406AE4F276D29A36387
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32929

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenA InternetOpenUrlA InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle

shlwapi

PathFileExistsW

netapi32

NetGetJoinInformation NetApiBufferFree

kernel32

SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA InitializeCriticalSectionAndSpinCount Sleep CreateProcessW CloseHandle CreateFileW ExpandEnvironmentStringsW GetLocaleInfoW DeleteFileW WriteFile GetTickCount GetProcAddress GetModuleHandleW IsValidLocale EnumSystemLocalesA CreateFileA GetUserDefaultLCID LCMapStringA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc RtlUnwind MultiByteToWideChar RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW WideCharToMultiByte LCMapStringW GetCPInfo HeapCreate VirtualFree VirtualAlloc HeapReAlloc ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetACP GetOEMCP IsValidCodePage GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer HeapSize GetLocaleInfoA GetStringTypeA GetStringTypeW

user32

wsprintfW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_218561da1c8f6b975d088e8ac4976795_elex_manuscrypt_phorpiex_rhadamanthys_stop

wininet

shlwapi

netapi32

kernel32

user32

shell32

generic