2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 2.8MB
Sample260930-alm1hsad36
SHA256 34f6953cea1a5d17c45f76a35a7bd5b1cf74b2e46f1b84baec7b8232df88d484
MD5 5aeff1d5982dfd030a2524758bb19eb1
SHA1 88b155345db42209b07859ffd0ef17909ef2ed1f
SHA512 3db49ae58d61ea461a218800b64aeee986b991da41ad529b42384cbf1f9f27574ce8824c87bc3c2a73b88977359823b37883b9e310ddf46028de65906887cd3d
SSDEEP 49152:7RFPhxSMmT8oWgBCaXKZt5TkFyAnh1EVRkhxSMmT8oWgBCaX:7RFP+M4FHX45Tk0AnMA+M4FHX
TLSH
T19BD523317BCBC4B3C80BD139CD61DB255A5BD938438155E3BB1C1BA86F20AD66A3E346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 2.8MB

2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH c32017e11c25a294e09845ff7e39a37e
SHA256 34f6953cea1a5d17c45f76a35a7bd5b1cf74b2e46f1b84baec7b8232df88d484
MD5 5aeff1d5982dfd030a2524758bb19eb1
SHA1 88b155345db42209b07859ffd0ef17909ef2ed1f
SHA512 3db49ae58d61ea461a218800b64aeee986b991da41ad529b42384cbf1f9f27574ce8824c87bc3c2a73b88977359823b37883b9e310ddf46028de65906887cd3d
SSDEEP 49152:7RFPhxSMmT8oWgBCaXKZt5TkFyAnh1EVRkhxSMmT8oWgBCaX:7RFP+M4FHX45Tk0AnMA+M4FHX
TLSH
T19BD523317BCBC4B3C80BD139CD61DB255A5BD938438155E3BB1C1BA86F20AD66A3E346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

J:\Develope\20160629_PipeConfirm_changetoAsync\V1.3.0.1\Release\itdrvpi.pdb

kernel32

GetModuleHandleW CreateNamedPipeW GetProcessHeap WriteFile InitializeCriticalSection LoadLibraryW Sleep SizeofResource LeaveCriticalSection ReadFile GetModuleFileNameW MultiByteToWideChar lstrlenW DisconnectNamedPipe FlushFileBuffers RaiseException VerifyVersionInfoW GetLastError SetLastError GetProcAddress EnterCriticalSection ResetEvent LocalAlloc OutputDebugStringW CreateEventW WaitForMultipleObjects lstrcmpiW DeleteCriticalSection GetCurrentThreadId ReleaseMutex CloseHandle LocalFree CreateThread ConnectNamedPipe SetEvent HeapFree InterlockedDecrement VerSetConditionMask InterlockedIncrement LoadLibraryExW HeapAlloc LoadResource FreeLibrary FindResourceW FindResourceExW WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA SetStdHandle CreateFileA LockResource CreateMutexW HeapDestroy HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind HeapCreate VirtualFree VirtualAlloc ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree LCMapStringW SetHandleCount GetFileType GetStartupInfoA SetFilePointer LCMapStringA WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

DefWindowProcW DestroyWindow CharNextW

advapi32

RegOpenKeyExW RegSetValueExW RegCloseKey RegEnumKeyExW GetSecurityDescriptorSacl RegCreateKeyExW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoUninitialize

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5aeff1d5982dfd030a2524758bb19eb1_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

ole32

oleaut32

comctl32

generic