2026-08-06_e3091f1727a6dc0ab403807fa78902fa_elex_manuscrypt_rhadamanthys_silence_stop

General

Target
2026-08-06_e3091f1727a6dc0ab403807fa78902fa_elex_manuscrypt_rhadamanthys_silence_stop
Size 204KB
Sample260807-afa4rsteka
SHA256 c66440f602a43297625a014529c0b4a458a92f23b7dd4bcba3ccc1fedb204b87
MD5 e3091f1727a6dc0ab403807fa78902fa
SHA1 79e3838692f12beccb46cedb176e671aba3b7bea
SHA512 d08cf8d9d75de48a957fd49418e705424ca61dc6e6da74cdf8ff86061d6be3fb6eb5e61dd6afb6dd5de8f17e43bba666ab7890e2de636318e23e1ca973bd4061
SSDEEP 3072:KEHuVcqMIrEM/3ruhHpPKeqv1l/fnv+8UMBZJrX5OFcCM:KEHQcqMIb3ihHIeqtl/HHZvOFcD
TLSH
T193247A123991C471E5B3427106F8DB321ABDBD320BA269DBBBD40B4D1A741D3A335BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_e3091f1727a6dc0ab403807fa78902fa_elex_manuscrypt_rhadamanthys_silence_stop

File Explorer

2026-08-06_e3091f1727a6dc0ab403807fa78902fa_elex_manuscrypt_rhadamanthys_silence_stop

.exe 204KB

2026-08-06_e3091f1727a6dc0ab403807fa78902fa_elex_manuscrypt_rhadamanthys_silence_stop

IMPHASH 9b441001a5ca4ead583edeb006ea59dd
SHA256 c66440f602a43297625a014529c0b4a458a92f23b7dd4bcba3ccc1fedb204b87
MD5 e3091f1727a6dc0ab403807fa78902fa
SHA1 79e3838692f12beccb46cedb176e671aba3b7bea
SHA512 d08cf8d9d75de48a957fd49418e705424ca61dc6e6da74cdf8ff86061d6be3fb6eb5e61dd6afb6dd5de8f17e43bba666ab7890e2de636318e23e1ca973bd4061
SSDEEP 3072:KEHuVcqMIrEM/3ruhHpPKeqv1l/fnv+8UMBZJrX5OFcCM:KEHQcqMIb3ihHIeqtl/HHZvOFcD
TLSH
T193247A123991C471E5B3427106F8DB321ABDBD320BA269DBBBD40B4D1A741D3A335BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

46238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA FindNextFileA CreateDirectoryA EnterCriticalSection LeaveCriticalSection DeleteFileA Sleep GetTickCount CreateFileA WriteFile CloseHandle CreateMutexA GetLastError SetFileAttributesA GetModuleFileNameA InitializeCriticalSectionAndSpinCount WaitForSingleObject ExitProcess SetLastError CreateProcessA CreateToolhelp32Snapshot Process32First Process32Next TerminateProcess GetCurrentProcess InterlockedDecrement WideCharToMultiByte SetEndOfFile CreateFileW SetEnvironmentVariableA ReadConsoleW WriteConsoleW SetStdHandle LoadLibraryW LoadLibraryExW OutputDebugStringW SetFilePointer HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetCurrentThreadId GetOEMCP GetACP IsValidCodePage InterlockedIncrement EncodePointer DecodePointer DeleteCriticalSection MultiByteToWideChar GetStringTypeW LocalFree HeapFree IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineA RaiseException RtlUnwind HeapAlloc GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetModuleFileNameW GetModuleHandleExW AreFileApisANSI HeapSize GetProcessHeap GetFileType GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FlushFileBuffers

user32

GetCursorPos

oleaut32

VariantClear

ws2_32

socket gethostbyname htons connect WSAStartup closesocket recv send WSACleanup WSAGetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_e3091f1727a6dc0ab403807fa78902fa_elex_manuscrypt_rhadamanthys_silence_stop

kernel32

user32

oleaut32

ws2_32

generic