2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 7.7MB
Sample260730-wnanvsej21
SHA256 34de7ebdaa81c38e846fce1a14c25d418d736646c231a882fcc13f4411e801ea
MD5 25109252793461ba704d3f59c6f49fc1
SHA1 6525fa56e45194a18b14db0f3a2c540dfdfc1b17
SHA512 a6a26748a0453902d25fcdc841bf6d594ce2bb30d4c1b112de9a0ffa66ad4d650477fc80e806d633ce0b16a0d1c734d030bb81d413c62d32638b29e8c77733ab
SSDEEP 196608:VYnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTl0RQk:VYjWMIizvqkwBEsQlc4uSfW6ETl0d
TLSH
T114863302BEDB9431F5FA1FB088608BDA9B3ABE305835806F7F9D015A7C655C49A79343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 7.7MB

2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH cc000e0a56358759c95f653af1246259
SHA256 34de7ebdaa81c38e846fce1a14c25d418d736646c231a882fcc13f4411e801ea
MD5 25109252793461ba704d3f59c6f49fc1
SHA1 6525fa56e45194a18b14db0f3a2c540dfdfc1b17
SHA512 a6a26748a0453902d25fcdc841bf6d594ce2bb30d4c1b112de9a0ffa66ad4d650477fc80e806d633ce0b16a0d1c734d030bb81d413c62d32638b29e8c77733ab
SSDEEP 196608:VYnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTl0RQk:VYjWMIizvqkwBEsQlc4uSfW6ETl0d
TLSH
T114863302BEDB9431F5FA1FB088608BDA9B3ABE305835806F7F9D015A7C655C49A79343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA RemoveDirectoryA SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA DeleteFileA GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject GetLongPathNameA GetTempPathA GetCommandLineA CopyFileA GetFileAttributesA LoadLibraryExA GetSystemDirectoryA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetEnvironmentVariableA GetDriveTypeA LocalAlloc DosDateTimeToFileTime LocalFileTimeToFileTime GetVersionExA SetFileTime CreateDirectoryA SetCurrentDirectoryA FindFirstFileA FindClose GetLastError GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree HeapReAlloc GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep HeapSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers

gdi32

CreateDCA SetBkColor SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_25109252793461ba704d3f59c6f49fc1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

gdi32

generic