General
- Target 2026-08-23_450e5b80f1371b69a4675ccee8541fa6_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 336KB
- Sample260824-p5dcrade32
- SHA256 0b0ea4058a6eefbbfe2c346b0570fb39b42dc199fbfb2ae85f3ec3ff819a823c
- MD5 450e5b80f1371b69a4675ccee8541fa6
- SHA1 07f83b4b534b245bde39f0d78cedf5ad012866f4
- SHA512 0c27298d60dfa1115bf5668156c60f7553df453de8e53286152ffac0863e57d35700ba562b3ee7226f9c316d6af4f827f33eb5139e875f8125c75a89246cedd0
- SSDEEP 6144:i+ctS0t0peL/UVhsjSurGa6xvwQKzbImVV0p+rlcM833ns1KYR/zgT2:Bctlt0peLm3n3+kT2
- TLSH T15774ADF1F2C2FF70C44E9436131591F06D79ACF3A6A464C77EA93FAB6A10264036E169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_450e5b80f1371b69a4675ccee8541fa6_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_450e5b80f1371b69a4675ccee8541fa6_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_450e5b80f1371b69a4675ccee8541fa6_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop
- Size 336KB
- SHA256 0b0ea4058a6eefbbfe2c346b0570fb39b42dc199fbfb2ae85f3ec3ff819a823c
- MD5 450e5b80f1371b69a4675ccee8541fa6
- SHA1 07f83b4b534b245bde39f0d78cedf5ad012866f4
- SHA512 0c27298d60dfa1115bf5668156c60f7553df453de8e53286152ffac0863e57d35700ba562b3ee7226f9c316d6af4f827f33eb5139e875f8125c75a89246cedd0
- SSDEEP 6144:i+ctS0t0peL/UVhsjSurGa6xvwQKzbImVV0p+rlcM833ns1KYR/zgT2:Bctlt0peLm3n3+kT2
- TLSH T15774ADF1F2C2FF70C44E9436131591F06D79ACF3A6A464C77EA93FAB6A10264036E169
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext