2026-08-09_90cee9c04c5ddc16caf4a1d5ca38e3eb_amadey_elex_floxif_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_90cee9c04c5ddc16caf4a1d5ca38e3eb_amadey_elex_floxif_karagany_manuscrypt_rhadamanthys_smoke-loader_stop
Size 618KB
Sample260809-hej92swtbw
SHA256 c8afd102fd05af46cb7c13bb0cf762f53f857eb1e346d1057e29f834d502d873
MD5 90cee9c04c5ddc16caf4a1d5ca38e3eb
SHA1 db617ec2e41a31f20a1dd5b9551e4dc5d590c4b2
SHA512 1f41a7538c7b5f198fd578147805a524a97998de6bed8aa6507ef28c150a207b8c377a029611c0751dac651cda9c6b6e1ee52700a5a989cb8b97484d71475085
SSDEEP 12288:HKGtcqsnfWMiSSSSSSSSSSSSSSSS8SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSh:qGcf7iSSSSSSSSSSSSSSSS8SSSSSSSSZ
TLSH
T17ED46D50A783C78DE472493872F7C83872F6BE3C59B6055AAB3B7AB92777241550280F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_90cee9c04c5ddc16caf4a1d5ca38e3eb_amadey_elex_floxif_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_90cee9c04c5ddc16caf4a1d5ca38e3eb_amadey_elex_floxif_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 618KB

2026-08-09_90cee9c04c5ddc16caf4a1d5ca38e3eb_amadey_elex_floxif_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH d9bb2bccda4f8de4bb5960d3898479c6
SHA256 c8afd102fd05af46cb7c13bb0cf762f53f857eb1e346d1057e29f834d502d873
MD5 90cee9c04c5ddc16caf4a1d5ca38e3eb
SHA1 db617ec2e41a31f20a1dd5b9551e4dc5d590c4b2
SHA512 1f41a7538c7b5f198fd578147805a524a97998de6bed8aa6507ef28c150a207b8c377a029611c0751dac651cda9c6b6e1ee52700a5a989cb8b97484d71475085
SSDEEP 12288:HKGtcqsnfWMiSSSSSSSSSSSSSSSS8SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSh:qGcf7iSSSSSSSSSSSSSSSS8SSSSSSSSZ
TLSH
T17ED46D50A783C78DE472493872F7C83872F6BE3C59B6055AAB3B7AB92777241550280F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e2:c2:24:55:a6:6a:17:c1:a3:b0:8f:f5:f8:9e:49:c3:df:fa:01:51:4d:28:7d:88:10:c6:ef:a9:a6:b9:fd:c3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Chains

Jun 29, 2016

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

e4:0d:b1:05:f7:d8:cd:88:9c:51:70:5b:a1:22:28:00:2a:d6:58:f2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Chains

Jun 29, 2016

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon,ST=Kyungki-Do,C=KR

Serial Number

26:18:1c:ed:f2:c1:13:e1:6a:c7:48:20:df:7a:38:a3

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jan 27, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Serial Number

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Serial Number

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 11, 2015 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

11815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\●PC 매뉴얼\◆Setup 파일 제작\Setup 파일_11차_160620_바탕화면 아이콘 제거 - 복사본\RunManual\Output\Package\Release\ManualSetup.pdb

kernel32

InterlockedDecrement WaitForSingleObject GetModuleFileNameW OutputDebugStringW lstrcpyW CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess CloseHandle EnterCriticalSection LeaveCriticalSection GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetSystemDirectoryW FindResourceExW FindResourceW SizeofResource LockResource RaiseException LoadResource FlushFileBuffers CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetStringTypeW MultiByteToWideChar WideCharToMultiByte LocalFree GetCommandLineW HeapSetInformation GetStartupInfoW EncodePointer DecodePointer SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW IsProcessorFeaturePresent Sleep RtlUnwind LoadLibraryW

advapi32

RegSetValueExW RegCloseKey RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyW

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx CoInitializeSecurity

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

shlwapi

PathRemoveFileSpecW

psapi

GetProcessImageFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_90cee9c04c5ddc16caf4a1d5ca38e3eb_amadey_elex_floxif_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

PE Signature issue

PE Signature issue

kernel32

advapi32

ole32

oleaut32

shlwapi

psapi

generic