2026-10-11_932168e7743a117b7a804ab4a5aad8eb_elex_manuscrypt_rhadamanthys_stealc_stop

General

Target
2026-10-11_932168e7743a117b7a804ab4a5aad8eb_elex_manuscrypt_rhadamanthys_stealc_stop
Size 1.2MB
Sample261012-s8hy7act2y
SHA256 4caa8e5575742887fc974822099a8040c77a8bd9ccc6de777e4b86a39bfc7a46
MD5 932168e7743a117b7a804ab4a5aad8eb
SHA1 e1e7f14fc0ce2292575073dd0225e3c015e765ac
SHA512 88afdf2e1eaa593cc8e3f716479cbc91c02ff600f68b2ef6f764ce01dbf29acfeebd4e234610fd7e0612da4679aff18f5aebd3c0f97958fc0b900752369e6a75
SSDEEP 12288:vT8eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:bd+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T102451241B586C4B7C4170A318B9986906BBE7D433FA7A44BFBC8378B98F05D846767B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_932168e7743a117b7a804ab4a5aad8eb_elex_manuscrypt_rhadamanthys_stealc_stop

File Explorer

2026-10-11_932168e7743a117b7a804ab4a5aad8eb_elex_manuscrypt_rhadamanthys_stealc_stop

.exe 1.2MB

2026-10-11_932168e7743a117b7a804ab4a5aad8eb_elex_manuscrypt_rhadamanthys_stealc_stop

IMPHASH 23b03c4242ab2c53cddd4b8775fd3564
SHA256 4caa8e5575742887fc974822099a8040c77a8bd9ccc6de777e4b86a39bfc7a46
MD5 932168e7743a117b7a804ab4a5aad8eb
SHA1 e1e7f14fc0ce2292575073dd0225e3c015e765ac
SHA512 88afdf2e1eaa593cc8e3f716479cbc91c02ff600f68b2ef6f764ce01dbf29acfeebd4e234610fd7e0612da4679aff18f5aebd3c0f97958fc0b900752369e6a75
SSDEEP 12288:vT8eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:bd+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T102451241B586C4B7C4170A318B9986906BBE7D433FA7A44BFBC8378B98F05D846767B0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Project\Perf\depot_erbium\3.7.0\ENWLS\Release_unicode\ENWLS.pdb

kernel32

GetLastError CreateNamedPipeW ReadFile WriteFile CloseHandle CreateFileW Sleep LocalFree GetProcAddress GetModuleHandleA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStdHandle GetModuleFileNameA ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType CreateThread HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId EnterCriticalSection LeaveCriticalSection RtlUnwind HeapSize VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA MultiByteToWideChar GetLocaleInfoA InitializeCriticalSection SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetEndOfFile CreateFileA DeleteCriticalSection GetLocalTime

advapi32

RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW SetServiceStatus

crypt32

CryptUnprotectData CryptProtectData

user32

wsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_932168e7743a117b7a804ab4a5aad8eb_elex_manuscrypt_rhadamanthys_stealc_stop

kernel32

advapi32

crypt32

user32

generic