2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop

General

Target
2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop
Size 702KB
Sample260802-gjjzeaware
SHA256 3e6050c270bfa8eece1156dd9c599fef36f6a98cd7e15909c934fe1801c173e0
MD5 8cc673061db9d3a8aa0d87eb4af09f85
SHA1 bd11721a73205029393d38ab4057b3c418efc122
SHA512 c279956569eccaf8734f6535dfe010857eac25f88abc7f595261b5855e885da3e1c3b6c4c0f3d9215b27884c9e6f9bff797c90a30083a48b75f701cc0f95e4ec
SSDEEP 12288:AnbcDwLStAP27j0RRTRpd8++d1duyOx94KJLZmX1:AnDLR274NpEd141x9FLZmX1
TLSH
T1A7E40101F9C041B1C4E629364CB996010ABBFD9795E0FE5762C877413837E91EB29AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop

File Explorer

2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop

.exe 702KB

2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop

IMPHASH 1b4b34e3c4982c8fce3e53558db7004e
SHA256 3e6050c270bfa8eece1156dd9c599fef36f6a98cd7e15909c934fe1801c173e0
MD5 8cc673061db9d3a8aa0d87eb4af09f85
SHA1 bd11721a73205029393d38ab4057b3c418efc122
SHA512 c279956569eccaf8734f6535dfe010857eac25f88abc7f595261b5855e885da3e1c3b6c4c0f3d9215b27884c9e6f9bff797c90a30083a48b75f701cc0f95e4ec
SSDEEP 12288:AnbcDwLStAP27j0RRTRpd8++d1duyOx94KJLZmX1:AnDLR274NpEd141x9FLZmX1
TLSH
T1A7E40101F9C041B1C4E629364CB996010ABBFD9795E0FE5762C877413837E91EB29AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11791

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount VirtualAlloc LoadLibraryA GetProcAddress FindResourceW SizeofResource LoadResource LockResource CreateFileW WriteFile CloseHandle DeleteFileW GetModuleFileNameW SetEnvironmentVariableW GetTempPathW GetTempFileNameW GetFileSize ReadFile GetModuleHandleW CreateProcessW GetEnvironmentVariableW WideCharToMultiByte GetLastError MultiByteToWideChar FindResourceExW GetCommandLineW GetSystemTimeAsFileTime HeapFree SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapSize RaiseException Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW RtlUnwind GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathFileExistsW PathRenameExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_8cc673061db9d3a8aa0d87eb4af09f85_elex_karagany_manuscrypt_rhadamanthys_stop

kernel32

shell32

shlwapi

generic