2026-07-30_a663c98acafde9c549dbce669af71010_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_a663c98acafde9c549dbce669af71010_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 29.9MB
Sample260730-dk13jaah44
SHA256 6c51583b6382dc9d5a6f9a705342492cbcbcba3407eaddfda00f4d8d60381344
MD5 a663c98acafde9c549dbce669af71010
SHA1 dd2bc272522f5b437aed67fca3decd8b42934199
SHA512 d82826357bdba4776acbe0948105bfcdbf8ab9391cc195eca6bae74fa698e3bd7d9545a49a2c5839f5103609f2c760c6bf128a0c448843814075eed13caa2044
SSDEEP 786432:t1LgP5Z9P50nAGDn7P5Bmq/QKaoH5YtNCcy4jWhNYZ+Q7SbfqbGTg:rL+BKL4BoZYMsSYDpKTg
TLSH
T115673326F7604152F11362FCAD2543BF61EC72626761DA1BEFB215189C832C53E36FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-30_a663c98acafde9c549dbce669af71010_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 29.9MB

2026-07-30_a663c98acafde9c549dbce669af71010_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH cc000e0a56358759c95f653af1246259
SHA256 6c51583b6382dc9d5a6f9a705342492cbcbcba3407eaddfda00f4d8d60381344
MD5 a663c98acafde9c549dbce669af71010
SHA1 dd2bc272522f5b437aed67fca3decd8b42934199
SHA512 d82826357bdba4776acbe0948105bfcdbf8ab9391cc195eca6bae74fa698e3bd7d9545a49a2c5839f5103609f2c760c6bf128a0c448843814075eed13caa2044
SSDEEP 786432:t1LgP5Z9P50nAGDn7P5Bmq/QKaoH5YtNCcy4jWhNYZ+Q7SbfqbGTg:rL+BKL4BoZYMsSYDpKTg
TLSH
T115673326F7604152F11362FCAD2543BF61EC72626761DA1BEFB215189C832C53E36FA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

81:d5:c6:78:3b:eb:14:b4:01:0c:18:78:90:2c:36:4c:4a:61:d9:67:43:4d:52:f9:39:e6:99:21:45:98:bb:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=742859,CN=Epson America\, Inc.,O=Epson America\, Inc.,L=Los Alamitos,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 15, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:65:8f:be:59:0f:4e:e3:a6:23:6c:00:47:15:13:81

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2024 - Nov 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

52628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA RemoveDirectoryA SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA DeleteFileA GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject GetLongPathNameA GetTempPathA GetCommandLineA CopyFileA GetFileAttributesA LoadLibraryExA GetSystemDirectoryA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetEnvironmentVariableA GetDriveTypeA LocalAlloc DosDateTimeToFileTime LocalFileTimeToFileTime GetVersionExA SetFileTime CreateDirectoryA SetCurrentDirectoryA FindFirstFileA FindClose GetLastError GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree HeapReAlloc GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep HeapSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers

gdi32

CreateDCA SetBkColor SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_a663c98acafde9c549dbce669af71010_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

gdi32

generic