2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

General

Target
2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee
Size 736KB
Sample260724-llpd5afe24
SHA256 2e687ff049ad46e17fbd88d7cd3d46a93384fc1734e235b45be012bd3b06144a
MD5 2362d5652ac6e49b6b9bb6ac1f092850
SHA1 8dde389a285869fef1053dcb1dfb4b36edac4682
SHA512 2a3b3b9f5e34c93bebb48513544d0bd0d4aefc70ddfc456ed92e235d8811724250c697bf72cd747308c9fd3c854426382ebc48cc610f14cb06a2759309e4a3d7
SSDEEP 12288:/6JUE3KfYXoPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y6:/6JUvfYXoPne87HtO/DF1+9codjeWyZx
TLSH
T157F4012076858031F36A07314AA9E6D40969AC780BE9F1CFF7B87D3A58345D38A7725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

File Explorer

2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

.exe 736KB

2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

IMPHASH 20d4a7cecbc24c54867f40bf047cc51e
SHA256 2e687ff049ad46e17fbd88d7cd3d46a93384fc1734e235b45be012bd3b06144a
MD5 2362d5652ac6e49b6b9bb6ac1f092850
SHA1 8dde389a285869fef1053dcb1dfb4b36edac4682
SHA512 2a3b3b9f5e34c93bebb48513544d0bd0d4aefc70ddfc456ed92e235d8811724250c697bf72cd747308c9fd3c854426382ebc48cc610f14cb06a2759309e4a3d7
SSDEEP 12288:/6JUE3KfYXoPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y6:/6JUvfYXoPne87HtO/DF1+9codjeWyZx
TLSH
T157F4012076858031F36A07314AA9E6D40969AC780BE9F1CFF7B87D3A58345D38A7725F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

41876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Project\acercloudsdk\Trunk\AcerPortal\Installer\newshortcut\Release\newshortcut.pdb

kernel32

GetFullPathNameW GetLocalTime OutputDebugStringW CloseHandle CreateFileW WriteConsoleW SetStdHandle LoadLibraryW GetConsoleMode GetConsoleCP SetFilePointer IsValidLocale EnumSystemLocalesA InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapReAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW RtlUnwind HeapAlloc CompareStringW GetCPInfo LCMapStringW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate IsProcessorFeaturePresent GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA FlushFileBuffers

user32

wvsprintfW wsprintfW

ole32

CoCreateInstance CoInitialize CoUninitialize PropVariantClear

shlwapi

SHStrDupW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_2362d5652ac6e49b6b9bb6ac1f092850_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

kernel32

user32

ole32

shlwapi

generic