2026-09-29_34203f4129306ac5b7ae268065cfe41e_elex_floxif_manuscrypt_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_34203f4129306ac5b7ae268065cfe41e_elex_floxif_manuscrypt_rhadamanthys_stealc_stop
Size 169KB
Sample260930-187xbasejc
SHA256 8f41b97f70963cdffcf01315d7974886c8c71f31e7e0954dc63da3293b1b9a29
MD5 34203f4129306ac5b7ae268065cfe41e
SHA1 18cbdeaabddf89a6bc2bfe8cb515963d1fdacfd9
SHA512 0bee326897887068b5896e2a2fe53eeb9c79f3c5787c55664073e2bff6ebe1f14c7f5e573176dafabf1e6802f8cff963a36aabc5b94f61531321deff3c2ad62d
SSDEEP 3072:dBasNYQhAZpsFVRKhCfjkWmi9Ab2lQBV+UdE+rECWp7hK1L8:dQsnhAvsjRK8fj1YfBV+UdvrEFp7hK1I
TLSH
T10A04BF4132A0C3F9E4921530353CD662ADFAF93D06BEC097B35616591EAC7C29E6871F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-29_34203f4129306ac5b7ae268065cfe41e_elex_floxif_manuscrypt_rhadamanthys_stealc_stop

File Explorer

2026-09-29_34203f4129306ac5b7ae268065cfe41e_elex_floxif_manuscrypt_rhadamanthys_stealc_stop

.exe 169KB

2026-09-29_34203f4129306ac5b7ae268065cfe41e_elex_floxif_manuscrypt_rhadamanthys_stealc_stop

IMPHASH 9c85be1956dc990952c2e2218e545c32
SHA256 8f41b97f70963cdffcf01315d7974886c8c71f31e7e0954dc63da3293b1b9a29
MD5 34203f4129306ac5b7ae268065cfe41e
SHA1 18cbdeaabddf89a6bc2bfe8cb515963d1fdacfd9
SHA512 0bee326897887068b5896e2a2fe53eeb9c79f3c5787c55664073e2bff6ebe1f14c7f5e573176dafabf1e6802f8cff963a36aabc5b94f61531321deff3c2ad62d
SSDEEP 3072:dBasNYQhAZpsFVRKhCfjkWmi9Ab2lQBV+UdE+rECWp7hK1L8:dQsnhAvsjRK8fj1YfBV+UdvrEFp7hK1I
TLSH
T10A04BF4132A0C3F9E4921530353CD662ADFAF93D06BEC097B35616591EAC7C29E6871F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3c:f8:cb:26:14:80:e6:44:ab:30:9b:4f:31:74:94:7b:97:35:34:7c:6b:79:5d:16:ec:16:22:5f:e5:7f:52:ca

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 29, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

fb:92:4b:4f:90:33:ac:85:05:64:fe:fa:52:a7:10:ab:a3:c6:fb:a9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 29, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:d4:53:f7:ca:e4:56:2c:f8:00:00:00:00:00:56

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Minor OS version

Major OS version

Entry point

12312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Sources\ADUService\output\Release\ADUService.pdb

kernel32

LocalFree GetModuleFileNameW GetProcessHeap HeapFree HeapAlloc OutputDebugStringW CloseHandle OutputDebugStringA QueueUserWorkItem CreateEventW Sleep SetEvent WaitForSingleObject GetLastError GetCommandLineW HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress EnterCriticalSection LeaveCriticalSection RaiseException ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapSize LoadLibraryW IsProcessorFeaturePresent HeapReAlloc FlushFileBuffers SetStdHandle WriteConsoleW CreateFileW

advapi32

ReportEventW RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA GetSecurityDescriptorDacl ControlService BuildExplicitAccessWithNameW SetEntriesInAclW QueryServiceStatus StartServiceW QueryServiceObjectSecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenServiceW RegisterEventSourceW StartServiceCtrlDispatcherW DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_34203f4129306ac5b7ae268065cfe41e_elex_floxif_manuscrypt_rhadamanthys_stealc_stop

PE Signature issue

PE Signature issue

kernel32

advapi32

generic