2026-09-22_06ed1fba0cf411278febe720a89dc4b9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-09-22_06ed1fba0cf411278febe720a89dc4b9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample260922-2qadrstdnb
SHA256 3212e06ec8a4a840722545359847480d7a45e6e6487c9a5a3153f8b7ee755331
MD5 06ed1fba0cf411278febe720a89dc4b9
SHA1 7e2f340819343422f37b5798447d01bb17de6319
SHA512 23b6bc63ea35f035da24fd3a595b7e1198cb695a07ae31fb1fdf30e3c9bd200f2742c6b2ae8202fcfcaa06edf55a6089445f3f769df070c0f50e5bec08ff0a2f
SSDEEP 24576:aREBKunvcwTmKd+n4al9n7wD1YvVz7/aZ:aRMJcwTmZ4Y9Mw
TLSH
T1215523217AC0D473C502A2708461DAD4AA76BEB0BB6440C7B76A357E5FB03E2573F297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_06ed1fba0cf411278febe720a89dc4b9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-22_06ed1fba0cf411278febe720a89dc4b9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-09-22_06ed1fba0cf411278febe720a89dc4b9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 5e34b111d5ca30f53910975361e811e1
SHA256 3212e06ec8a4a840722545359847480d7a45e6e6487c9a5a3153f8b7ee755331
MD5 06ed1fba0cf411278febe720a89dc4b9
SHA1 7e2f340819343422f37b5798447d01bb17de6319
SHA512 23b6bc63ea35f035da24fd3a595b7e1198cb695a07ae31fb1fdf30e3c9bd200f2742c6b2ae8202fcfcaa06edf55a6089445f3f769df070c0f50e5bec08ff0a2f
SSDEEP 24576:aREBKunvcwTmKd+n4al9n7wD1YvVz7/aZ:aRMJcwTmZ4Y9Mw
TLSH
T1215523217AC0D473C502A2708461DAD4AA76BEB0BB6440C7B76A357E5FB03E2573F297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress LoadLibraryW FreeLibrary FlushFileBuffers CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile CreateFileA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_06ed1fba0cf411278febe720a89dc4b9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic