2026-08-04_98b1f564005d04e7808aa82dfd8bc9db_elex_karagany_manuscrypt_rhadamanthys_stop

General

Target
2026-08-04_98b1f564005d04e7808aa82dfd8bc9db_elex_karagany_manuscrypt_rhadamanthys_stop
Size 702KB
Sample260804-2hxt4asbkc
SHA256 89391bdb76916c562729dee0cce6fd93060155f0491a342578b17c503a8ec16f
MD5 98b1f564005d04e7808aa82dfd8bc9db
SHA1 1c600040ae3abdb9de2d87fb950481086a3953cd
SHA512 296a150859c397b2dc09ef12b52ac4ceb5548ffdbfa0a5f03689f075d84fd1aefdb6e3228a136348103b6415a5fe8aa187bd562f481934b5be520eba5fccc20e
SSDEEP 12288:AnbcDwMD3PQfZWR41+90LY+bavkJksYNve8RHoFd2u6AGu9bKJLZmX1:AnDC3P+Zkw+aLJXksYNz+Fd2uN9OLZmF
TLSH
T16FE4F142B9C040B4D4E56E764CF94A020ABAFE5781E4F94772C83B063973D529739AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_98b1f564005d04e7808aa82dfd8bc9db_elex_karagany_manuscrypt_rhadamanthys_stop

File Explorer

2026-08-04_98b1f564005d04e7808aa82dfd8bc9db_elex_karagany_manuscrypt_rhadamanthys_stop

.exe 702KB

2026-08-04_98b1f564005d04e7808aa82dfd8bc9db_elex_karagany_manuscrypt_rhadamanthys_stop

IMPHASH 1b4b34e3c4982c8fce3e53558db7004e
SHA256 89391bdb76916c562729dee0cce6fd93060155f0491a342578b17c503a8ec16f
MD5 98b1f564005d04e7808aa82dfd8bc9db
SHA1 1c600040ae3abdb9de2d87fb950481086a3953cd
SHA512 296a150859c397b2dc09ef12b52ac4ceb5548ffdbfa0a5f03689f075d84fd1aefdb6e3228a136348103b6415a5fe8aa187bd562f481934b5be520eba5fccc20e
SSDEEP 12288:AnbcDwMD3PQfZWR41+90LY+bavkJksYNve8RHoFd2u6AGu9bKJLZmX1:AnDC3P+Zkw+aLJXksYNz+Fd2uN9OLZmF
TLSH
T16FE4F142B9C040B4D4E56E764CF94A020ABAFE5781E4F94772C83B063973D529739AFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11791

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount VirtualAlloc LoadLibraryA GetProcAddress FindResourceW SizeofResource LoadResource LockResource CreateFileW WriteFile CloseHandle DeleteFileW GetModuleFileNameW SetEnvironmentVariableW GetTempPathW GetTempFileNameW GetFileSize ReadFile GetModuleHandleW CreateProcessW GetEnvironmentVariableW WideCharToMultiByte GetLastError MultiByteToWideChar FindResourceExW GetCommandLineW GetSystemTimeAsFileTime HeapFree SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapSize RaiseException Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW RtlUnwind GetStringTypeW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle WriteConsoleW HeapDestroy

shell32

ShellExecuteW

shlwapi

PathFileExistsW PathRenameExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_98b1f564005d04e7808aa82dfd8bc9db_elex_karagany_manuscrypt_rhadamanthys_stop

kernel32

shell32

shlwapi

generic