2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 662KB
Sample260826-dxd4jayte1
SHA256 8e912eeaead37fddce601a21efaede8ccd0c3aaea3c36f7507ab980a8048d8d4
MD5 ed915ec20ec2f3dc238fcfff184971ab
SHA1 a320c6ff96fc7708ee4d1c5ded9837f61b96916a
SHA512 4fa6ba5d81a73255974254fd051970dad235f4760f11a1f2b906bb7f2855e2479c9733aea052428c06ee3b6ca0aaec3d096db844fc8049efb8e2707d5efee950
SSDEEP 12288:PjGrFY7gQoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:arF8JosqjnhMgeiCl7G0nehbGZpbD
TLSH
T180E4137275D1C0B3C45118768695E6699C2BBE329B2448C3FB562AFD9FB07D0CB3A207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 662KB

2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 634d31f2e05d4e5c4b3f6537a6f91568
SHA256 8e912eeaead37fddce601a21efaede8ccd0c3aaea3c36f7507ab980a8048d8d4
MD5 ed915ec20ec2f3dc238fcfff184971ab
SHA1 a320c6ff96fc7708ee4d1c5ded9837f61b96916a
SHA512 4fa6ba5d81a73255974254fd051970dad235f4760f11a1f2b906bb7f2855e2479c9733aea052428c06ee3b6ca0aaec3d096db844fc8049efb8e2707d5efee950
SSDEEP 12288:PjGrFY7gQoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:arF8JosqjnhMgeiCl7G0nehbGZpbD
TLSH
T180E4137275D1C0B3C45118768695E6699C2BBE329B2448C3FB562AFD9FB07D0CB3A207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dev\trunk_temp\win32\Elevator\Release\Elevator.pdb

kernel32

FindResourceExW CloseHandle WaitForSingleObject GetModuleFileNameW GetCurrentThreadId GetCurrentProcessId OutputDebugStringW GetVersionExW FindResourceW WTSGetActiveConsoleSessionId CreateProcessW GetCurrentProcess GetConsoleWindow SetCurrentDirectoryW CreateFileA SetEnvironmentVariableA SizeofResource LockResource LoadResource GetLastError GlobalFree GetProcessId GlobalAlloc CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetSystemTimeAsFileTime GetModuleHandleW Sleep GetProcAddress ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind WideCharToMultiByte GetTimeZoneInformation GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringW MultiByteToWideChar GetTimeFormatA GetDateFormatA WriteFile GetStdHandle GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount VirtualAlloc LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer FlushFileBuffers

user32

ShowWindow

advapi32

AllocateAndInitializeSid GetTokenInformation OpenProcessToken CreateProcessAsUserW DuplicateTokenEx EqualSid

shell32

ShellExecuteExW

shlwapi

PathFileExistsW

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_ed915ec20ec2f3dc238fcfff184971ab_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

shlwapi

wtsapi32

userenv

generic