2026-08-15_e891737e81565c22246a08e68063dd1c_elex_karagany_manuscrypt_rhadamanthys_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_e891737e81565c22246a08e68063dd1c_elex_karagany_manuscrypt_rhadamanthys_stop_virut
Size 4.2MB
Sample260815-begetswcpc
SHA256 eb1f6e6f8571d94cc6dd3c6ff809af28ec22712efd94875a294a46d518a1b97f
MD5 e891737e81565c22246a08e68063dd1c
SHA1 414c7a50500f86ff671356c096280bdbbf205f06
SHA512 c1071b7d530d5d6de806290f453657936ce459daf04a19e904e62492f8e50fc87014821cef167d90480e21e9127854ba7a8ecdf4e068c4590c4f98ff4f66edd2
SSDEEP 3072:UdHIfAHkKZ4sgehtZTWnz3gVrUHJdyBDxYoJDSV:OWAHkB8A8AH3YDxYoJDSV
TLSH
T171165B027A99C472D0A2023054968B71CA3BFD718F7A85A7B394BF5D3D793C1663A363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-15_e891737e81565c22246a08e68063dd1c_elex_karagany_manuscrypt_rhadamanthys_stop_virut

File Explorer

2026-08-15_e891737e81565c22246a08e68063dd1c_elex_karagany_manuscrypt_rhadamanthys_stop_virut

.exe 4.2MB

2026-08-15_e891737e81565c22246a08e68063dd1c_elex_karagany_manuscrypt_rhadamanthys_stop_virut

IMPHASH 4a4ca0354e0731cebb377504b6053f97
SHA256 eb1f6e6f8571d94cc6dd3c6ff809af28ec22712efd94875a294a46d518a1b97f
MD5 e891737e81565c22246a08e68063dd1c
SHA1 414c7a50500f86ff671356c096280bdbbf205f06
SHA512 c1071b7d530d5d6de806290f453657936ce459daf04a19e904e62492f8e50fc87014821cef167d90480e21e9127854ba7a8ecdf4e068c4590c4f98ff4f66edd2
SSDEEP 3072:UdHIfAHkKZ4sgehtZTWnz3gVrUHJdyBDxYoJDSV:OWAHkB8A8AH3YDxYoJDSV
TLSH
T171165B027A99C472D0A2023054968B71CA3BFD718F7A85A7B394BF5D3D793C1663A363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

13:b4:41:5f:11:f2:10:87:94:5c:5f:cc:4f:68:43:af:a5:82:7c:5b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Chains

Apr 21, 2014

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Serial Number

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2013 - Mar 10, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

4368017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\work\360tray\branches\360Metro_Toasts\Release\360Toasts.pdb

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoGetActivationFactory RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateStringReference

shlwapi

PathRemoveFileSpecW PathAppendW PathFileExistsW SHStrDupW PathCombineW StrStrW

kernel32

GetConsoleMode GetConsoleCP LCMapStringEx CreateFileW CloseHandle GetCurrentProcessId GetModuleHandleW GetModuleFileNameW LoadLibraryW FreeLibrary DeleteCriticalSection InitializeCriticalSection OutputDebugStringW LeaveCriticalSection GetProcAddress EnterCriticalSection InterlockedIncrement InterlockedDecrement GetCurrentThreadId FlushFileBuffers SetStdHandle Process32NextW OpenProcess K32GetModuleFileNameExW lstrlenW RaiseException GetStringTypeW WideCharToMultiByte RtlUnwind LoadLibraryExW Sleep HeapSize GetCPInfo GetOEMCP GetACP IsValidCodePage Process32FirstW WriteConsoleW TerminateProcess GetCurrentProcess FlsFree ReadConsoleW CreateToolhelp32Snapshot GetSystemTimeAsFileTime SetFilePointerEx WriteFile ReadFile MultiByteToWideChar GetLastError SetLastError CreateMutexW HeapAlloc HeapFree WaitForSingleObject GetProcessHeap GetAtomNameW AddAtomW ReleaseMutex TlsAlloc FindAtomW DeleteAtom TlsFree GetCommandLineW EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent HeapReAlloc ExitProcess GetModuleHandleExW GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue

user32

TranslateMessage GetMessageW GetDesktopWindow DispatchMessageW FindWindowW PostThreadMessageW MonitorFromWindow

shell32

ShellExecuteExW SHGetSpecialFolderPathW

ole32

PropVariantClear CoCreateInstance CoInitialize

imm32

ImmDisableIME

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_e891737e81565c22246a08e68063dd1c_elex_karagany_manuscrypt_rhadamanthys_stop_virut

PE Signature issue

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

shlwapi

kernel32

user32

shell32

ole32

imm32

generic