2026-10-08_3d30cfc06953543965a1fde89190e839_elex_manuscrypt_rhadamanthys_stealc_stop

General

Target
2026-10-08_3d30cfc06953543965a1fde89190e839_elex_manuscrypt_rhadamanthys_stealc_stop
Size 2.3MB
Sample261009-t9sqfs1set
SHA256 3ba33237420aeb92b4072ce8669e9440c6f007f1c303c3d377739a316150969e
MD5 3d30cfc06953543965a1fde89190e839
SHA1 9af38bfe07484b811efcb4052cf7b13c6b4159ef
SHA512 1aa4c0c7c563ccb86cdc8d053a57266ab648c2165f40a01a9d86357e89ee4d1464651a106e0f7df352600bb5cbd67db86fa55739e211641af8b3d4f5fecc8125
SSDEEP 24576:yjPcYzpwrqDOd5lAcCgygaL3vB0WaKngL2jdshRTdG1YxITqvfPkbIcbjLm:E2ld5ucCg1u3vCWarSj8RoTCCW
TLSH
T19BB5233CB5A6AFF0C0397F711D64568C27632E3568D6801FE7A4362B7A7A2644DAC330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_3d30cfc06953543965a1fde89190e839_elex_manuscrypt_rhadamanthys_stealc_stop

File Explorer

2026-10-08_3d30cfc06953543965a1fde89190e839_elex_manuscrypt_rhadamanthys_stealc_stop

.exe 2.3MB

2026-10-08_3d30cfc06953543965a1fde89190e839_elex_manuscrypt_rhadamanthys_stealc_stop

IMPHASH e704a1e9d00cf7f1088726813157c9f5
SHA256 3ba33237420aeb92b4072ce8669e9440c6f007f1c303c3d377739a316150969e
MD5 3d30cfc06953543965a1fde89190e839
SHA1 9af38bfe07484b811efcb4052cf7b13c6b4159ef
SHA512 1aa4c0c7c563ccb86cdc8d053a57266ab648c2165f40a01a9d86357e89ee4d1464651a106e0f7df352600bb5cbd67db86fa55739e211641af8b3d4f5fecc8125
SSDEEP 24576:yjPcYzpwrqDOd5lAcCgygaL3vB0WaKngL2jdshRTdG1YxITqvfPkbIcbjLm:E2ld5ucCg1u3vCWarSj8RoTCCW
TLSH
T19BB5233CB5A6AFF0C0397F711D64568C27632E3568D6801FE7A4362B7A7A2644DAC330
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\lenovo\drivergenius\trunk\product\win32\dbginfo\LenovoDrvSrv.pdb

kernel32

CloseHandle CreateMutexW DeleteCriticalSection LeaveCriticalSection WritePrivateProfileStringW GetLocalTime EnterCriticalSection DeleteFileW lstrcpyW Sleep GetModuleFileNameW InitializeCriticalSection GetLastError HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetProcAddress GetModuleHandleA ExitProcess GetVersionExA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA LoadLibraryA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers RaiseException

advapi32

CreateServiceW OpenSCManagerW CloseServiceHandle OpenServiceW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW StartServiceW ChangeServiceConfigW ControlService DeleteService ChangeServiceConfig2W

dgbase

ord3 ord2 ord1

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_3d30cfc06953543965a1fde89190e839_elex_manuscrypt_rhadamanthys_stealc_stop

kernel32

advapi32

dgbase

generic