2026-08-15_5f86ad46d674e6b8603774c4a8f2f94b_elex_hijackloader_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_5f86ad46d674e6b8603774c4a8f2f94b_elex_hijackloader_manuscrypt_rhadamanthys_stop
Size 177KB
Sample260815-ldf3safa46
SHA256 e3431743b945ba937691454d3c46fcf23a3e586e80d621c7d52f8cef70445423
MD5 5f86ad46d674e6b8603774c4a8f2f94b
SHA1 d0095b523f4b8f6bb8e132267baf16ead158089f
SHA512 bdab66908af66ca469a2432eb6e665dc61b8485b6dffb8d14aee3dbb3d0dc498dc8c21fa92cddc8727b6d0324d01f4603e558cce28fb3ceadfc86f00276bd628
SSDEEP 3072:aMIT8ZAQfGm7IOqmLOqOXcGyqxmsYGdXZQHX5a0lSczDSb:tGQfh7WmLOqOXfyqxmsYGdCHsSSb
TLSH
T1D9042980BB908CFEFCB61AB7BC9286651532AC1D5BD040DB33D972642932BD15EFD216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-15_5f86ad46d674e6b8603774c4a8f2f94b_elex_hijackloader_manuscrypt_rhadamanthys_stop

.exe 177KB

2026-08-15_5f86ad46d674e6b8603774c4a8f2f94b_elex_hijackloader_manuscrypt_rhadamanthys_stop

IMPHASH b89c5f49da2538d1cb5050b8cda4aa82
SHA256 e3431743b945ba937691454d3c46fcf23a3e586e80d621c7d52f8cef70445423
MD5 5f86ad46d674e6b8603774c4a8f2f94b
SHA1 d0095b523f4b8f6bb8e132267baf16ead158089f
SHA512 bdab66908af66ca469a2432eb6e665dc61b8485b6dffb8d14aee3dbb3d0dc498dc8c21fa92cddc8727b6d0324d01f4603e558cce28fb3ceadfc86f00276bd628
SSDEEP 3072:aMIT8ZAQfGm7IOqmLOqOXcGyqxmsYGdXZQHX5a0lSczDSb:tGQfh7WmLOqOXfyqxmsYGdCHsSSb
TLSH
T1D9042980BB908CFEFCB61AB7BC9286651532AC1D5BD040DB33D972642932BD15EFD216
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f3:80:4f:93:54:e4:0d:67:0d:df:e4:18:50:31:42:08:38:d5:e5:f3:95:f7:3c:91:1f:43:a1:63:5f:44:17:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=220-81-63160,CN=Kings Information & Network Co.\,Ltd.,O=Kings Information & Network Co.\,Ltd.,L=Hanam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Aug 9, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

8e:fc:b5:2c:fa:27:85:dd:f9:7c:25:21:d8:32:aa:80:f5:4b:a6:cb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Aug 9, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

Serial Number

02:89:89:90:2a:95:08:fa:e2:20:67:5f:67:8a:cd:6f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2020 - Oct 28, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

38787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WORK\LAB\kess\bin\Release\pb_sharelocker.pdb

kernel32

GetCurrentProcess CloseHandle SetUnhandledExceptionFilter GetSystemDirectoryW FreeLibrary GetPrivateProfileIntW OutputDebugStringW GetWindowsDirectoryW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetPrivateProfileSectionW GetFileAttributesW CreateMutexW GetModuleFileNameW DeleteFileW GetModuleHandleW GetPrivateProfileStringW FindFirstFileW SetFileAttributesW GetCurrentProcessId FindClose GetPrivateProfileSectionNamesW lstrcpyW GetTempPathW GetShortPathNameW Sleep FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount LoadLibraryA GetCurrentThreadId GetProcAddress FindNextFileW LoadLibraryW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError ExitProcess VirtualFree VirtualAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

DispatchMessageW TranslateMessage GetMessageW SetWindowTextW RegisterClassW DefWindowProcW PostQuitMessage wsprintfW SendMessageW FindWindowW CreateWindowExW

advapi32

RegCloseKey RegQueryValueExW RegCreateKeyExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_5f86ad46d674e6b8603774c4a8f2f94b_elex_hijackloader_manuscrypt_rhadamanthys_stop

kernel32

user32

advapi32

shell32

generic