2026-10-10_475c741312cb80626f9f8fa652f0046c_elex_manuscrypt_rhadamanthys_stop

General

Target
2026-10-10_475c741312cb80626f9f8fa652f0046c_elex_manuscrypt_rhadamanthys_stop
Size 868KB
Sample261011-srcqvacb44
SHA256 97d7e974dca037b48fec008d5d1f3d83440f275d007727ee059ecf1648b7e2a6
MD5 475c741312cb80626f9f8fa652f0046c
SHA1 236676e4ad2cb2bfd12166f6290b213d02e31f94
SHA512 246c0e71bdf81fbb972a59e608b19f3496ffd98f396021cacd7cf71bf9ed8001528e9c4bb4a50cbdd86aebc7445ddf19c4665eab0d3c41e3c954783d1b287c4d
SSDEEP 24576:TGfi70ZdZOXld9oRNf7Jm9a2dPpC9vxGxea:uaAud9oRpJm9a2dUt
TLSH
T10C1523513F89D5BBDA22113B4942C2AA333FED103F22D99367A8178F5E317B56DA6301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_475c741312cb80626f9f8fa652f0046c_elex_manuscrypt_rhadamanthys_stop

File Explorer

2026-10-10_475c741312cb80626f9f8fa652f0046c_elex_manuscrypt_rhadamanthys_stop

.exe 868KB

2026-10-10_475c741312cb80626f9f8fa652f0046c_elex_manuscrypt_rhadamanthys_stop

IMPHASH 596f9f02dd52dccb0f14c56d1898f7d3
SHA256 97d7e974dca037b48fec008d5d1f3d83440f275d007727ee059ecf1648b7e2a6
MD5 475c741312cb80626f9f8fa652f0046c
SHA1 236676e4ad2cb2bfd12166f6290b213d02e31f94
SHA512 246c0e71bdf81fbb972a59e608b19f3496ffd98f396021cacd7cf71bf9ed8001528e9c4bb4a50cbdd86aebc7445ddf19c4665eab0d3c41e3c954783d1b287c4d
SSDEEP 24576:TGfi70ZdZOXld9oRNf7Jm9a2dPpC9vxGxea:uaAud9oRpJm9a2dUt
TLSH
T10C1523513F89D5BBDA22113B4942C2AA333FED103F22D99367A8178F5E317B56DA6301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

30566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\KINGSOFT_DUBA\Build\Build_Src\kcloud\kcloud\src\kdump\kdumpfix\Release\kdumpfix.pdb

kernel32

RaiseException SizeofResource LockResource LoadResource FindResourceW FindResourceExW CloseHandle OpenProcess GetProcAddress GetModuleHandleW CreateProcessW LocalFree Sleep GetLastError WaitForSingleObject GetCurrentProcessId GetPrivateProfileIntW lstrcmpiW GetCommandLineW MultiByteToWideChar WideCharToMultiByte ReadFile GetFileSize CreateFileW WriteFile lstrlenA FlushFileBuffers EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale RtlUnwind GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringA LCMapStringW ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount VirtualAlloc GetStringTypeA GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecW

user32

UnregisterClassA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_475c741312cb80626f9f8fa652f0046c_elex_manuscrypt_rhadamanthys_stop

kernel32

shell32

shlwapi

user32

generic