2026-10-16_ee73be968c55cc191c9817ca413d95e7_cobalt-strike_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_ee73be968c55cc191c9817ca413d95e7_cobalt-strike_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stealc_stop
Size 151KB
Sample261017-dthyba1y3n
SHA256 69cfe8ae7b60543773834d7d56fd99ffb6504da020246e7ee84f5e96c82ff7a9
MD5 ee73be968c55cc191c9817ca413d95e7
SHA1 1d4bf9120c86bc5353aceaed72633bfe406bb4c0
SHA512 b3ed0b991bbba7cfc4aa620a3ff26ed6cc90b7cdfa26164972b502d4b44f3a84438f8f6103c9a1fa6c0440447d007761ba5cd8a93c5e875a78dc5a4396a4a4fc
SSDEEP 1536:C1NktvUiUahUlgjMcVFflamFy4+qc/GzFSsWjcdQSBM8ziHXkXJSvo:CH6veeUIMcVFHn+30DvM8ziHXkXJSv
TLSH
T101E3071236C08470F76A0B312864F9D04A69ED795AE0E98FF3787E3A59351C35A3729F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-16_ee73be968c55cc191c9817ca413d95e7_cobalt-strike_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stealc_stop

.exe 151KB

2026-10-16_ee73be968c55cc191c9817ca413d95e7_cobalt-strike_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stealc_stop

IMPHASH f46f038876c4997838d10713e7824c13
SHA256 69cfe8ae7b60543773834d7d56fd99ffb6504da020246e7ee84f5e96c82ff7a9
MD5 ee73be968c55cc191c9817ca413d95e7
SHA1 1d4bf9120c86bc5353aceaed72633bfe406bb4c0
SHA512 b3ed0b991bbba7cfc4aa620a3ff26ed6cc90b7cdfa26164972b502d4b44f3a84438f8f6103c9a1fa6c0440447d007761ba5cd8a93c5e875a78dc5a4396a4a4fc
SSDEEP 1536:C1NktvUiUahUlgjMcVFflamFy4+qc/GzFSsWjcdQSBM8ziHXkXJSvo:CH6veeUIMcVFHn+30DvM8ziHXkXJSv
TLSH
T101E3071236C08470F76A0B312864F9D04A69ED795AE0E98FF3787E3A59351C35A3729F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

98:97:d9:f3:1e:7a:03:23:63:f2:f4:0a:54:88:9d:73:df:dc:9c:da:bd:13:d6:a9:76:c0:03:42:b5:ca:93:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=DOCTORSOFT CO.\,LTD.,O=DOCTORSOFT CO.\,LTD.,ST=Seoul,C=KR

Chains

Oct 12, 2021

CN=DOCTORSOFT CO.\,LTD.,O=DOCTORSOFT CO.\,LTD.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=DOCTORSOFT CO.\,LTD.,O=DOCTORSOFT CO.\,LTD.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DOCTORSOFT CO.\,LTD.,O=DOCTORSOFT CO.\,LTD.,ST=Seoul,C=KR

Serial Number

83:1c:c4:e6:f0:e6:4f:ff:7f:a7:0d:eb:a9:97:cd:ad

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 31, 2021 - Aug 30, 2024

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Minor OS version

Major OS version

Entry point

13294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Project\RemoteControl\Agent\Release\cgisvcstater.pdb

kernel32

TerminateProcess MultiByteToWideChar WideCharToMultiByte CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle SetFilePointerEx LCMapStringW OutputDebugStringW HeapReAlloc GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType GetProcessHeap GetCurrentThreadId CloseHandle GetCurrentProcess GetModuleHandleW GetProcAddress WriteFile GetModuleFileNameW Sleep GetLastError GetConsoleMode GetConsoleCP GetCPInfo GetOEMCP GetACP IsValidCodePage LoadLibraryExW EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetCommandLineW HeapAlloc HeapFree IsDebuggerPresent IsProcessorFeaturePresent RaiseException RtlUnwind HeapSize EnterCriticalSection LeaveCriticalSection DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStdHandle

user32

UpdateWindow EndDialog PostQuitMessage PostMessageW EndPaint BeginPaint LoadStringW DestroyWindow DialogBoxParamW DefWindowProcW ShowWindow CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW SetTimer LoadAcceleratorsW

advapi32

ControlService StartServiceW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_ee73be968c55cc191c9817ca413d95e7_cobalt-strike_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

advapi32

generic