2026-10-02_e95034d4a7c414ef5c3d4ebfbc7421a6_elex_geminiduke_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_e95034d4a7c414ef5c3d4ebfbc7421a6_elex_geminiduke_manuscrypt_rhadamanthys_stop
Size 124KB
Sample261002-3fwppaxyhw
SHA256 cd088ec2028dae54f8810261ae848811085f249f8043faee795465c36828a22e
MD5 e95034d4a7c414ef5c3d4ebfbc7421a6
SHA1 b2af85fa6e2f0ffeffca27aa7657bc14bc27440e
SHA512 5240eb96ef44f1140f5bae926013786132ae45aeef776c7f43b1dd67935aead4c7a3ecf6157c76278aec321982b8af08c2cf6ce2c47b11edeec630379c2a2773
SSDEEP 1536:nar79OsBbwQFUhhjJZIfzDz1H5q+VnkmsYPUrFIW8zYBt6S48DklJLjs7:ar79ZBE/ozds+oEUh3YYBt6oDWs7
TLSH
T159C3B03175C6C8B3D80745720ACEE6BEEA6BA9340731D6C377546B63AD313D1A936382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_e95034d4a7c414ef5c3d4ebfbc7421a6_elex_geminiduke_manuscrypt_rhadamanthys_stop

File Explorer

2026-10-02_e95034d4a7c414ef5c3d4ebfbc7421a6_elex_geminiduke_manuscrypt_rhadamanthys_stop

.exe 124KB

2026-10-02_e95034d4a7c414ef5c3d4ebfbc7421a6_elex_geminiduke_manuscrypt_rhadamanthys_stop

IMPHASH 88acdb4432bde7e3dba1815f9d938107
SHA256 cd088ec2028dae54f8810261ae848811085f249f8043faee795465c36828a22e
MD5 e95034d4a7c414ef5c3d4ebfbc7421a6
SHA1 b2af85fa6e2f0ffeffca27aa7657bc14bc27440e
SHA512 5240eb96ef44f1140f5bae926013786132ae45aeef776c7f43b1dd67935aead4c7a3ecf6157c76278aec321982b8af08c2cf6ce2c47b11edeec630379c2a2773
SSDEEP 1536:nar79OsBbwQFUhhjJZIfzDz1H5q+VnkmsYPUrFIW8zYBt6S48DklJLjs7:ar79ZBE/ozds+oEUh3YYBt6oDWs7
TLSH
T159C3B03175C6C8B3D80745720ACEE6BEEA6BA9340731D6C377546B63AD313D1A936382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

gethostbyname inet_addr WSAStartup WSACleanup gethostname

urlmon

URLDownloadToFileA

version

VerQueryValueA GetFileVersionInfoA

wininet

InternetGetConnectedState InternetQueryOptionA

kernel32

ReadFile GetFileSize CloseHandle CreateFileA HeapAlloc GetProcessHeap HeapFree FindClose FindNextFileA GetSystemTimeAsFileTime FindFirstFileA Sleep GetDriveTypeA GetLogicalDriveStringsA GetProcAddress LoadLibraryA FreeLibrary OpenProcess GetCurrentProcessId lstrcatA lstrcpyA WriteFile SetFilePointer GlobalMemoryStatus QueryPerformanceCounter GetTickCount GetLastError FileTimeToSystemTime GetWindowsDirectoryA GetSystemDirectoryA GetEnvironmentStrings WideCharToMultiByte GetVersionExA GetComputerNameA GetLocalTime DeleteFileA WinExec GetTempPathA ExitProcess WaitForSingleObject CreateEventA GetTempFileNameA GetModuleFileNameA OpenEventA RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA TlsGetValue TlsSetValue InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement RaiseException LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP InitializeCriticalSection GetStdHandle VirtualFree GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW VirtualAlloc HeapReAlloc

advapi32

RegCreateKeyA RegSetValueExA GetUserNameA RegQueryValueA RegEnumValueA RegCloseKey RegOpenKeyExA RegQueryValueExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_e95034d4a7c414ef5c3d4ebfbc7421a6_elex_geminiduke_manuscrypt_rhadamanthys_stop

wsock32

urlmon

version

wininet

kernel32

advapi32

generic