2026-08-08_2843c811b5fae71baf3bce75dcb4d7ff_elex_manuscrypt_rhadamanthys_silence_stop

General

Target
2026-08-08_2843c811b5fae71baf3bce75dcb4d7ff_elex_manuscrypt_rhadamanthys_silence_stop
Size 204KB
Sample260808-gk9lfsvtcs
SHA256 6e77700d166d93a1a565edc0d618b3b7f703fa83c30e3d8f9c02d04f8507310c
MD5 2843c811b5fae71baf3bce75dcb4d7ff
SHA1 1963fb2afc7b2dc7e343a1333859a9b73719d24c
SHA512 978d82ee366f8ea45ced3e5c3e13beb3bfaf8a66b593dba95ba49ddda8536a5eddf232291fc266e5e07efc5fea3b87dfd50ae7a104a1b4a8a544673fbfac980e
SSDEEP 3072:KEHuVcqMIrEM/3ruhHpPKeqv1l/fnv+8UMBZJrX5hFcCM:KEHQcqMIb3ihHIeqtl/HHZvhFcD
TLSH
T101247A127991C471E5B3427106F8DB321ABDBD320BA269DBBBD40B4D1A741D3A335BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_2843c811b5fae71baf3bce75dcb4d7ff_elex_manuscrypt_rhadamanthys_silence_stop

File Explorer

2026-08-08_2843c811b5fae71baf3bce75dcb4d7ff_elex_manuscrypt_rhadamanthys_silence_stop

.exe 204KB

2026-08-08_2843c811b5fae71baf3bce75dcb4d7ff_elex_manuscrypt_rhadamanthys_silence_stop

IMPHASH 9b441001a5ca4ead583edeb006ea59dd
SHA256 6e77700d166d93a1a565edc0d618b3b7f703fa83c30e3d8f9c02d04f8507310c
MD5 2843c811b5fae71baf3bce75dcb4d7ff
SHA1 1963fb2afc7b2dc7e343a1333859a9b73719d24c
SHA512 978d82ee366f8ea45ced3e5c3e13beb3bfaf8a66b593dba95ba49ddda8536a5eddf232291fc266e5e07efc5fea3b87dfd50ae7a104a1b4a8a544673fbfac980e
SSDEEP 3072:KEHuVcqMIrEM/3ruhHpPKeqv1l/fnv+8UMBZJrX5hFcCM:KEHQcqMIb3ihHIeqtl/HHZvhFcD
TLSH
T101247A127991C471E5B3427106F8DB321ABDBD320BA269DBBBD40B4D1A741D3A335BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

46238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA FindNextFileA CreateDirectoryA EnterCriticalSection LeaveCriticalSection DeleteFileA Sleep GetTickCount CreateFileA WriteFile CloseHandle CreateMutexA GetLastError SetFileAttributesA GetModuleFileNameA InitializeCriticalSectionAndSpinCount WaitForSingleObject ExitProcess SetLastError CreateProcessA CreateToolhelp32Snapshot Process32First Process32Next TerminateProcess GetCurrentProcess InterlockedDecrement WideCharToMultiByte SetEndOfFile CreateFileW SetEnvironmentVariableA ReadConsoleW WriteConsoleW SetStdHandle LoadLibraryW LoadLibraryExW OutputDebugStringW SetFilePointer HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetCurrentThreadId GetOEMCP GetACP IsValidCodePage InterlockedIncrement EncodePointer DecodePointer DeleteCriticalSection MultiByteToWideChar GetStringTypeW LocalFree HeapFree IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineA RaiseException RtlUnwind HeapAlloc GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetModuleFileNameW GetModuleHandleExW AreFileApisANSI HeapSize GetProcessHeap GetFileType GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FlushFileBuffers

user32

GetCursorPos

oleaut32

VariantClear

ws2_32

socket gethostbyname htons connect WSAStartup closesocket recv send WSACleanup WSAGetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_2843c811b5fae71baf3bce75dcb4d7ff_elex_manuscrypt_rhadamanthys_silence_stop

kernel32

user32

oleaut32

ws2_32

generic