2026-08-04_2a5cf432f273f9bf82cf436f9b7dd12c_elex_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_2a5cf432f273f9bf82cf436f9b7dd12c_elex_manuscrypt_rhadamanthys_stop
Size 1.3MB
Sample260804-jsyj9sam71
SHA256 86b4aab0aceddcf6d21fed592ded22e1ae838fd52f7a6559ccfefe69b61bdc52
MD5 2a5cf432f273f9bf82cf436f9b7dd12c
SHA1 d4851819d7c742645ba278951a321ef7b19e2c08
SHA512 bcb0b5e9a57efc4adab91483c4fbdb219902b7585865d77f1558416790d7054acb6c5478fb6051947089301aea36835ef6cba7d4a0cd8b9ceda1ca0282321c81
SSDEEP 1536:8oRGPF6MBG41Eghz9LhH62dblE0RkSYOn/TebLkZh6jh5yj+87tv2O:xiwWE6xL/bllv7ebLkZh6F5yD5
TLSH
T134556A117AD2C4B6C48650314DA6DB925B7FFD320B6189CB73783B2E4E313D05A3A2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_2a5cf432f273f9bf82cf436f9b7dd12c_elex_manuscrypt_rhadamanthys_stop

File Explorer

2026-08-04_2a5cf432f273f9bf82cf436f9b7dd12c_elex_manuscrypt_rhadamanthys_stop

.exe 1.3MB

2026-08-04_2a5cf432f273f9bf82cf436f9b7dd12c_elex_manuscrypt_rhadamanthys_stop

IMPHASH 7a7c3cde55e4aecb0491aa196a5edd7a
SHA256 86b4aab0aceddcf6d21fed592ded22e1ae838fd52f7a6559ccfefe69b61bdc52
MD5 2a5cf432f273f9bf82cf436f9b7dd12c
SHA1 d4851819d7c742645ba278951a321ef7b19e2c08
SHA512 bcb0b5e9a57efc4adab91483c4fbdb219902b7585865d77f1558416790d7054acb6c5478fb6051947089301aea36835ef6cba7d4a0cd8b9ceda1ca0282321c81
SSDEEP 1536:8oRGPF6MBG41Eghz9LhH62dblE0RkSYOn/TebLkZh6jh5yj+87tv2O:xiwWE6xL/bllv7ebLkZh6F5yD5
TLSH
T134556A117AD2C4B6C48650314DA6DB925B7FFD320B6189CB73783B2E4E313D05A3A2A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1409024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\5.0\exe\vc\GUAssistComSvc\sourcecode\GUAssistComSvc\Release\GUAssistComSvc.pdb

kernel32

FindResourceW LoadLibraryExW GetCommandLineW GetCurrentProcess EnterCriticalSection LeaveCriticalSection LoadResource CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers SizeofResource MultiByteToWideChar FreeLibrary SetEvent InterlockedDecrement InterlockedIncrement GetCurrentThreadId CreateEventW CreateThread Sleep GetModuleFileNameW lstrcmpiW GetModuleHandleW GetProcAddress GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException lstrlenW WaitForSingleObject CloseHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA GetConsoleMode GetConsoleCP SetFilePointer WideCharToMultiByte IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount LoadLibraryA HeapSize GetStartupInfoW HeapAlloc HeapFree RtlUnwind SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent VirtualAlloc HeapReAlloc

user32

PostThreadMessageW GetMessageW DispatchMessageW LoadStringW CharNextW CharUpperW MessageBoxW TranslateMessage

advapi32

RegisterServiceCtrlHandlerW RegEnumKeyExW ControlService DeleteService CreateServiceW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW OpenSCManagerW OpenServiceW CloseServiceHandle SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource StartServiceCtrlDispatcherW

ole32

CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject StringFromGUID2 CoCreateInstance CoInitialize CoTaskMemFree

oleaut32

VarUI4FromStr SysStringLen SysFreeString LoadRegTypeLi RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString

shlwapi

PathIsNetworkPathW PathFileExistsW

mpr

WNetGetConnectionW WNetAddConnection2W

Name

.text

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_2a5cf432f273f9bf82cf436f9b7dd12c_elex_manuscrypt_rhadamanthys_stop

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

mpr

generic