2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 7.5MB
Sample260824-knwesaej21
SHA256 d63d969cf79d4c259354a5a104c5142dbc18c5541cadaac0517c484b0803a0fb
MD5 7437351742f772583d2e0fc06a79c156
SHA1 c8e9cc4c2b0e265d9a1cc3f35c25d604729f6bb7
SHA512 e34475b06506400f015d36c47fecbdf895f44c0527dee555c9a17d1d55a466d5018e3c7799af7300aabd660677382e9415a17bccb405b027c7e3d0a020497176
SSDEEP 196608:6SGXeD1sb291kfEe1/mzi18barGioBSMH6aQcGiRfVQBWG:67XW1f7AFczimb7nRe3wWB
TLSH
T1B9863313F294C061D63F12360C6DA6581767799ACDB8688F5F8B86486FFD0883E71BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 7.5MB

2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 23c22ba8cc2a21a5dc13e55d6ed68008
SHA256 d63d969cf79d4c259354a5a104c5142dbc18c5541cadaac0517c484b0803a0fb
MD5 7437351742f772583d2e0fc06a79c156
SHA1 c8e9cc4c2b0e265d9a1cc3f35c25d604729f6bb7
SHA512 e34475b06506400f015d36c47fecbdf895f44c0527dee555c9a17d1d55a466d5018e3c7799af7300aabd660677382e9415a17bccb405b027c7e3d0a020497176
SSDEEP 196608:6SGXeD1sb291kfEe1/mzi18barGioBSMH6aQcGiRfVQBWG:67XW1f7AFczimb7nRe3wWB
TLSH
T1B9863313F294C061D63F12360C6DA6581767799ACDB8688F5F8B86486FFD0883E71BC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA GetWindowsDirectoryA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA WideCharToMultiByte CreateProcessA CloseHandle FindNextFileA DeleteFileA GetTickCount GetLongPathNameA GetTempPathA GetCommandLineA lstrcmpiA WaitForSingleObject CopyFileA GetFileAttributesA LoadLibraryExA GetSystemDirectoryA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile SetFilePointer GetEnvironmentVariableA GetDriveTypeA LocalAlloc DosDateTimeToFileTime GetVersionExA LocalFileTimeToFileTime SetFileTime CreateDirectoryA SetCurrentDirectoryA GetCurrentDirectoryA FindFirstFileA FindClose RemoveDirectoryA GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree HeapReAlloc GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep HeapSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers

gdi32

SetBkColor SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject ExtTextOutA

advapi32

RegQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

gdi32

advapi32

generic