2026-08-27_512a1c5054b8c3582bd6817de6251abf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-08-27_512a1c5054b8c3582bd6817de6251abf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop
Size 1.6MB
Sample260827-wdlclscl21
SHA256 19236ebe7643ec57577e45592ab66e95df217ada2afae105e3617efd3f73ed21
MD5 512a1c5054b8c3582bd6817de6251abf
SHA1 ee2bca2e8b7f2b667fa368184eeffa01c4440ce9
SHA512 d327eeb3e1ee376597a4dcce2b93ceceae8484be96a1cc9d6aecc7d00ebd5fe92ac2d75fffd90ae7f7279abd033022794daf04f3e9661e6ecc61757f4968fce5
SSDEEP 24576:d2eSjpDodStZJW5GnQBZ+1WNQ+TM3AJT2NyZiz88M31sSoDyTA9TGaecrf+S:rmbt3IVTL/lsSnU9TG2rf+S
TLSH
T12E85A2B0991A6A7FE33BCB7B896E7D258E1533B3BA5390CB5030359005722D2BF0655E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_512a1c5054b8c3582bd6817de6251abf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-27_512a1c5054b8c3582bd6817de6251abf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 1.6MB

2026-08-27_512a1c5054b8c3582bd6817de6251abf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 5b561a4544ca660ceece3e54c8b399f8
SHA256 19236ebe7643ec57577e45592ab66e95df217ada2afae105e3617efd3f73ed21
MD5 512a1c5054b8c3582bd6817de6251abf
SHA1 ee2bca2e8b7f2b667fa368184eeffa01c4440ce9
SHA512 d327eeb3e1ee376597a4dcce2b93ceceae8484be96a1cc9d6aecc7d00ebd5fe92ac2d75fffd90ae7f7279abd033022794daf04f3e9661e6ecc61757f4968fce5
SSDEEP 24576:d2eSjpDodStZJW5GnQBZ+1WNQ+TM3AJT2NyZiz88M31sSoDyTA9TGaecrf+S:rmbt3IVTL/lsSnU9TG2rf+S
TLSH
T12E85A2B0991A6A7FE33BCB7B896E7D258E1533B3BA5390CB5030359005722D2BF0655E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14519

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WorkSpace\ST_Projects_XY\TPSP\TPSP独立版本\Source_TpspDll\Release\TpspCln_Exe.pdb

kernel32

GetTickCount GetLastError OutputDebugStringA GetNativeSystemInfo FreeLibrary HeapAlloc HeapFree VirtualFree GetProcessHeap IsBadReadPtr SetLastError GetProcAddress VirtualAlloc LoadLibraryA VirtualProtect ExitProcess MapViewOfFile GetCurrentProcess OpenProcess Sleep TerminateProcess OpenMutexA GetModuleHandleA CreateMutexA CloseHandle OpenFileMappingA GetSystemTime CreateThread FlushFileBuffers WriteConsoleW SetStdHandle HeapSize LoadLibraryW MultiByteToWideChar WideCharToMultiByte HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetCurrentThreadId HeapCreate WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent RaiseException GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind LCMapStringW GetStringTypeW CreateFileW

user32

DispatchMessageA TranslateMessage GetMessageA

wininet

FindFirstUrlCacheEntryA FindNextUrlCacheEntryA DeleteUrlCacheEntry

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_512a1c5054b8c3582bd6817de6251abf_amadey_elex_karagany_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

wininet

generic