2026-09-10_a6f838bdbd19fca13f38b9e9a3c04379_elex_manuscrypt_rhadamanthys_silence_stop

General

Target
2026-09-10_a6f838bdbd19fca13f38b9e9a3c04379_elex_manuscrypt_rhadamanthys_silence_stop
Size 204KB
Sample260910-pm6atashpe
SHA256 225d772b28970fab5e6f6cd0449378ea36e57184a603513e0f0e5918dea904e7
MD5 a6f838bdbd19fca13f38b9e9a3c04379
SHA1 a28a55949148fd25d7f5d3079efd812ad44bddf9
SHA512 543322fe84a1dea40041312b978e61507f148944de1285f6ae71f4c8f542a98b892ade66ef2e83564976deab2e3ecbf7f51f603b04da2585e7cddde59e308311
SSDEEP 3072:KEHuVcqMIrEM/3ruhHpPKeqv1l/fnv+8UMBZJrX5oFcCM:KEHQcqMIb3ihHIeqtl/HHZvoFcD
TLSH
T165247B1279D1C471E5B3427106F8DB321ABDBD320BA269DBBB940B4D1A741D3A335BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_a6f838bdbd19fca13f38b9e9a3c04379_elex_manuscrypt_rhadamanthys_silence_stop

File Explorer

2026-09-10_a6f838bdbd19fca13f38b9e9a3c04379_elex_manuscrypt_rhadamanthys_silence_stop

.exe 204KB

2026-09-10_a6f838bdbd19fca13f38b9e9a3c04379_elex_manuscrypt_rhadamanthys_silence_stop

IMPHASH 9b441001a5ca4ead583edeb006ea59dd
SHA256 225d772b28970fab5e6f6cd0449378ea36e57184a603513e0f0e5918dea904e7
MD5 a6f838bdbd19fca13f38b9e9a3c04379
SHA1 a28a55949148fd25d7f5d3079efd812ad44bddf9
SHA512 543322fe84a1dea40041312b978e61507f148944de1285f6ae71f4c8f542a98b892ade66ef2e83564976deab2e3ecbf7f51f603b04da2585e7cddde59e308311
SSDEEP 3072:KEHuVcqMIrEM/3ruhHpPKeqv1l/fnv+8UMBZJrX5oFcCM:KEHQcqMIb3ihHIeqtl/HHZvoFcD
TLSH
T165247B1279D1C471E5B3427106F8DB321ABDBD320BA269DBBB940B4D1A741D3A335BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

46238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileA FindNextFileA CreateDirectoryA EnterCriticalSection LeaveCriticalSection DeleteFileA Sleep GetTickCount CreateFileA WriteFile CloseHandle CreateMutexA GetLastError SetFileAttributesA GetModuleFileNameA InitializeCriticalSectionAndSpinCount WaitForSingleObject ExitProcess SetLastError CreateProcessA CreateToolhelp32Snapshot Process32First Process32Next TerminateProcess GetCurrentProcess InterlockedDecrement WideCharToMultiByte SetEndOfFile CreateFileW SetEnvironmentVariableA ReadConsoleW WriteConsoleW SetStdHandle LoadLibraryW LoadLibraryExW OutputDebugStringW SetFilePointer HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetCurrentThreadId GetOEMCP GetACP IsValidCodePage InterlockedIncrement EncodePointer DecodePointer DeleteCriticalSection MultiByteToWideChar GetStringTypeW LocalFree HeapFree IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineA RaiseException RtlUnwind HeapAlloc GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetModuleFileNameW GetModuleHandleExW AreFileApisANSI HeapSize GetProcessHeap GetFileType GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FlushFileBuffers

user32

GetCursorPos

oleaut32

VariantClear

ws2_32

socket gethostbyname htons connect WSAStartup closesocket recv send WSACleanup WSAGetLastError

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_a6f838bdbd19fca13f38b9e9a3c04379_elex_manuscrypt_rhadamanthys_silence_stop

kernel32

user32

oleaut32

ws2_32

generic