2026-09-30_6f28c7c8a82ef4549d88029f993a6cb5_elex_manuscrypt_rhadamanthys_stop

General

Target
2026-09-30_6f28c7c8a82ef4549d88029f993a6cb5_elex_manuscrypt_rhadamanthys_stop
Size 647KB
Sample261001-ppgegatdqa
SHA256 3639f3ee097ba3611fbcb58129ed81596d1693bb26b227734a28c6b880363cfe
MD5 6f28c7c8a82ef4549d88029f993a6cb5
SHA1 7e958f1c72bc334aadceadc18f1b8607e2eff533
SHA512 11e20f88318d2ab507a4b02ebc682130e33b8a6a81d4301d9c4d25dd631de493b0b97dee45de9646af8e89bff10abce34b33d3416a907212989bb188553aba4c
SSDEEP 12288:EvmE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:lfkYc4R/II+zE9ENax9p5rZY
TLSH
T1A3E42305B1E2C031D2A3437085A8DA60D73FFE76A1B890933785B95E5EB52F259BE307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_6f28c7c8a82ef4549d88029f993a6cb5_elex_manuscrypt_rhadamanthys_stop

File Explorer

2026-09-30_6f28c7c8a82ef4549d88029f993a6cb5_elex_manuscrypt_rhadamanthys_stop

.exe 647KB

2026-09-30_6f28c7c8a82ef4549d88029f993a6cb5_elex_manuscrypt_rhadamanthys_stop

IMPHASH 32de3c7f405429e673d2a440e61f9432
SHA256 3639f3ee097ba3611fbcb58129ed81596d1693bb26b227734a28c6b880363cfe
MD5 6f28c7c8a82ef4549d88029f993a6cb5
SHA1 7e958f1c72bc334aadceadc18f1b8607e2eff533
SHA512 11e20f88318d2ab507a4b02ebc682130e33b8a6a81d4301d9c4d25dd631de493b0b97dee45de9646af8e89bff10abce34b33d3416a907212989bb188553aba4c
SSDEEP 12288:EvmE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:lfkYc4R/II+zE9ENax9p5rZY
TLSH
T1A3E42305B1E2C031D2A3437085A8DA60D73FFE76A1B890933785B95E5EB52F259BE307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15287

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

VS_PostClean_WDExpress.pdb

kernel32

GetCommandLineW GetEnvironmentVariableW lstrcmpiW HeapSetInformation LocalFree GetTempPathW ExpandEnvironmentStringsW GetVersion GetModuleHandleW GetProcAddress ReadFile SetEndOfFile GetLocalTime IsDebuggerPresent IsProcessorFeaturePresent GetLastError SetLastError InterlockedIncrement InterlockedDecrement GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess HeapFree HeapAlloc RaiseException EnterCriticalSection LeaveCriticalSection RtlUnwind FlushFileBuffers WideCharToMultiByte GetConsoleCP GetConsoleMode CloseHandle Sleep IsValidCodePage GetACP GetOEMCP GetCPInfo LoadLibraryExW OutputDebugStringW LoadLibraryW CreateFileW SetStdHandle SetFilePointerEx WriteConsoleW HeapReAlloc GetStringTypeW HeapSize LCMapStringEx ReadConsoleW

user32

MessageBoxW

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_6f28c7c8a82ef4549d88029f993a6cb5_elex_manuscrypt_rhadamanthys_stop

kernel32

user32

shell32

generic