2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 1.2MB
Sample260806-2p23dsscjf
SHA256 88e503bf4f6d3b4e855bba0b6774cb39b4996610165b7017b884bd6fde94e2df
MD5 a70d9e4522c3273a8ad99dfaafc1ab26
SHA1 a9597cbe3304be8785d49f4b5a78c7b4fcda3153
SHA512 f5c67de1bb46cd12fa44a8edb8c2e8c18bf9361a469f4cc4207a4af3abff55b97a33286e899df9404cdbd6cac4da12f4fe0375d2ba2bba7a9c95ab4091ef0e78
SSDEEP 24576:I/0/wH2fMinErsWguWHbL7pYcVX6u5MSZgEwYpkhj9thjtfHQpxhwc:1W2frO1fW7L7pPVqu5MSZqd9tHfHQpxv
TLSH
T125452363B455D431E0222830D476E2F18279B532AA7594CF6BAAC7FD9E327C0DA74723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

.exe 1.2MB

2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 1f9bfa161e887ffd84c70fe847d0894d
SHA256 88e503bf4f6d3b4e855bba0b6774cb39b4996610165b7017b884bd6fde94e2df
MD5 a70d9e4522c3273a8ad99dfaafc1ab26
SHA1 a9597cbe3304be8785d49f4b5a78c7b4fcda3153
SHA512 f5c67de1bb46cd12fa44a8edb8c2e8c18bf9361a469f4cc4207a4af3abff55b97a33286e899df9404cdbd6cac4da12f4fe0375d2ba2bba7a9c95ab4091ef0e78
SSDEEP 24576:I/0/wH2fMinErsWguWHbL7pYcVX6u5MSZgEwYpkhj9thjtfHQpxhwc:1W2frO1fW7L7pPVqu5MSZqd9tHfHQpxv
TLSH
T125452363B455D431E0222830D476E2F18279B532AA7594CF6BAAC7FD9E327C0DA74723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bf:9f:50:fd:a7:68:78:c3:fb:dd:a6:8a:29:68:3e:3c:64:e6:38:ec:2c:68:f8:f9:7d:bb:42:87:14:aa:9c:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=BLOCKCHAIN ADVANCES LTD,OU=IT Dept,O=BLOCKCHAIN ADVANCES LTD,POSTALCODE=W1U 6TU,STREET=3rd Floor 120 Baker Street,L=London,ST=London,C=GB

Chains

Aug 6, 2026

CN=BLOCKCHAIN ADVANCES LTD,OU=IT Dept,O=BLOCKCHAIN ADVANCES LTD,POSTALCODE=W1U 6TU,STREET=3rd Floor 120 Baker Street,L=London,ST=London,C=GB

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=BLOCKCHAIN ADVANCES LTD,OU=IT Dept,O=BLOCKCHAIN ADVANCES LTD,POSTALCODE=W1U 6TU,STREET=3rd Floor 120 Baker Street,L=London,ST=London,C=GB

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=BLOCKCHAIN ADVANCES LTD,OU=IT Dept,O=BLOCKCHAIN ADVANCES LTD,POSTALCODE=W1U 6TU,STREET=3rd Floor 120 Baker Street,L=London,ST=London,C=GB

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=BLOCKCHAIN ADVANCES LTD,OU=IT Dept,O=BLOCKCHAIN ADVANCES LTD,POSTALCODE=W1U 6TU,STREET=3rd Floor 120 Baker Street,L=London,ST=London,C=GB

Serial Number

79:d0:57:d5:ab:18:35:b2:0e:55:27:fc:f1:01:92:cc

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 25, 2019 - Sep 24, 2020

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Minor OS version

Major OS version

Entry point

12919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\win7\Release\DrvMain.pdb

kernel32

CreateProcessW GetCurrentProcess WaitForSingleObject GetTickCount WriteFile OpenProcess WideCharToMultiByte Sleep SizeofResource TerminateProcess ReadFile CreateFileW lstrlenW GetTempPathW GetFileSizeEx LoadResource Process32FirstW LockResource CreateEventW GetModuleFileNameA Process32NextW CreateToolhelp32Snapshot OutputDebugStringA WinExec CloseHandle DeleteFileW CreateThread WriteConsoleW SetStdHandle LoadLibraryW FindResourceW FindResourceExW GetLastError SetFilePointer RtlUnwind RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress ExitProcess GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime IsProcessorFeaturePresent LCMapStringW MultiByteToWideChar GetStringTypeW GetConsoleCP GetConsoleMode FlushFileBuffers

user32

wsprintfW wsprintfA

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

shlwapi

PathFileExistsW

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_a70d9e4522c3273a8ad99dfaafc1ab26_agent-tesla_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stealc_stop

PE Signature issue

kernel32

user32

advapi32

shlwapi

psapi

generic