2026-09-24_0daed4e81ff5dc4775ba11da68c7848c_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-09-24_0daed4e81ff5dc4775ba11da68c7848c_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop
Size 256KB
Sample260925-sgknpsyeja
SHA256 51af60abbf8f33932301afbdb96f5fba3958584c0daf2b22b91555b5fc4c27ab
MD5 0daed4e81ff5dc4775ba11da68c7848c
SHA1 37ac224ceda9799402c551da5ecf3cc9640be281
SHA512 1c5f655d6907dd1147c700aa2228aa02cc4f82d15111da8dd7e9908e309ce73c082f23024dfca6735c2ccb5806d3af8cf3a9c2aa06e8c7a662dd5570373f23fc
SSDEEP 3072:4d0qtIbo2sHT9JkhHztq1MpOVla2lQBV+UdE+rECWp7hKZ:4dXubo22UhA1MpOgBV+UdvrEFp7hKZ
TLSH
T10B445A01764187E5F7150B303968E6C119F9AE3E2AF5E09FE338B9385979283467722F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_0daed4e81ff5dc4775ba11da68c7848c_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-24_0daed4e81ff5dc4775ba11da68c7848c_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 256KB

2026-09-24_0daed4e81ff5dc4775ba11da68c7848c_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH 735c1e1fdea7fe0322b8fa22179c488b
SHA256 51af60abbf8f33932301afbdb96f5fba3958584c0daf2b22b91555b5fc4c27ab
MD5 0daed4e81ff5dc4775ba11da68c7848c
SHA1 37ac224ceda9799402c551da5ecf3cc9640be281
SHA512 1c5f655d6907dd1147c700aa2228aa02cc4f82d15111da8dd7e9908e309ce73c082f23024dfca6735c2ccb5806d3af8cf3a9c2aa06e8c7a662dd5570373f23fc
SSDEEP 3072:4d0qtIbo2sHT9JkhHztq1MpOVla2lQBV+UdE+rECWp7hKZ:4dXubo22UhA1MpOgBV+UdvrEFp7hKZ
TLSH
T10B445A01764187E5F7150B303968E6C119F9AE3E2AF5E09FE338B9385979283467722F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\working\installer\coinstaller\modified\updcoinst\release\coinst.pdb

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiOpenDeviceInterfaceRegKey SetupDiEnumDeviceInterfaces

winspool.drv

GetPrinterDataExW ord204 ClosePrinter GetPrinterW SetPrinterW DeletePrinter EnumPrintersW OpenPrinterW

kernel32

WriteConsoleA SetStdHandle GetLocaleInfoA CloseHandle GetModuleFileNameW GetTempPathW CreateFileW FormatMessageW LocalFree SetEndOfFile WideCharToMultiByte GetTimeFormatW GetSystemTime GetConsoleOutputCP ReleaseMutex GetLastError GlobalAlloc GlobalFree GetCurrentProcess LoadLibraryW GetProcAddress FreeLibrary CreateMutexW DeviceIoControl GetOverlappedResult Sleep MultiByteToWideChar GetVersionExW WriteConsoleW CreateFileA FlushFileBuffers WriteFile FreeEnvironmentStringsW HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP HeapSize RaiseException LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection VirtualAlloc HeapReAlloc RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

advapi32

RegQueryValueExW IsTextUnicode ImpersonateLoggedOnUser GetTokenInformation OpenProcessToken RevertToSelf RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_0daed4e81ff5dc4775ba11da68c7848c_amadey_elex_floxif_manuscrypt_rhadamanthys_smoke-loader_stop

setupapi

winspool.drv

kernel32

advapi32

generic