2026-08-01_9634cbbd608a87c0978523f1a7591884_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-08-01_9634cbbd608a87c0978523f1a7591884_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 488KB
Sample260801-trytradj3v
SHA256 a3d0888d5cf9268ec443902bdeb9eadda7217814f40d834026d3d8565d5fe95e
MD5 9634cbbd608a87c0978523f1a7591884
SHA1 e2d9186c8dd06eb223b9580fd52ef8e9d6ef5236
SHA512 25c5eef6f4891194d42b3d09e2d8b80c6c281b34113cf1bf9e1e3de9bac270d1d4790c18fe797a74093adceba0c31da85fa816ae2295fd5c3d6ecf8e70835be7
SSDEEP 12288:o2RI+TSQD6HXPSzvzviZbsdiXq3stSwM8nu:xRI+ej3mvsq3sVLu
TLSH
T1A7B49D42B35946D0CE7D2132DA76BB48A1790EE1DFA8A9476DDCBC3A3CB47D027180D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_9634cbbd608a87c0978523f1a7591884_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-01_9634cbbd608a87c0978523f1a7591884_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 488KB

2026-08-01_9634cbbd608a87c0978523f1a7591884_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 5e34b111d5ca30f53910975361e811e1
SHA256 a3d0888d5cf9268ec443902bdeb9eadda7217814f40d834026d3d8565d5fe95e
MD5 9634cbbd608a87c0978523f1a7591884
SHA1 e2d9186c8dd06eb223b9580fd52ef8e9d6ef5236
SHA512 25c5eef6f4891194d42b3d09e2d8b80c6c281b34113cf1bf9e1e3de9bac270d1d4790c18fe797a74093adceba0c31da85fa816ae2295fd5c3d6ecf8e70835be7
SSDEEP 12288:o2RI+TSQD6HXPSzvzviZbsdiXq3stSwM8nu:xRI+ej3mvsq3sVLu
TLSH
T1A7B49D42B35946D0CE7D2132DA76BB48A1790EE1DFA8A9476DDCBC3A3CB47D027180D9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress LoadLibraryW FreeLibrary FlushFileBuffers CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile CreateFileA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_9634cbbd608a87c0978523f1a7591884_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic