2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop

General

Target
2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop
Size 1.5MB
Sample261024-27ls5axwes
SHA256 1ef9f698c54c6411ac7cd05a03a75fe2d790995820475141dad2b0d586f7f547
MD5 020f1c06d0ce7224eb2186aea89cfa1e
SHA1 631e5d945581e64dff6586f2f9e501241e3577a8
SHA512 d22203890fc2908ca848bd1e1fe20a0026389b8b9d93d107746c05b01239d60b927e38e9b0b236827a480cba7c5dad8368a3c3ddc218ab8170a5270fe885cb0d
SSDEEP 12288:NmsihqDqtneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:YHte+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FD751250B1C0C0B3C466163489A9CB70AB2EFEB21B79D587F788A7699DB06D0C7713D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop

File Explorer

2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop

.exe 1.5MB

2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop

IMPHASH 2283c3c7d8559865b50ae697efc4e670
SHA256 1ef9f698c54c6411ac7cd05a03a75fe2d790995820475141dad2b0d586f7f547
MD5 020f1c06d0ce7224eb2186aea89cfa1e
SHA1 631e5d945581e64dff6586f2f9e501241e3577a8
SHA512 d22203890fc2908ca848bd1e1fe20a0026389b8b9d93d107746c05b01239d60b927e38e9b0b236827a480cba7c5dad8368a3c3ddc218ab8170a5270fe885cb0d
SSDEEP 12288:NmsihqDqtneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:YHte+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FD751250B1C0C0B3C466163489A9CB70AB2EFEB21B79D587F788A7699DB06D0C7713D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Work\KOR\overseas\LsDump\Rel_ID\LsDump.pdb

wininet

InternetOpenA InternetConnectA FtpSetCurrentDirectoryA FtpPutFileA InternetCloseHandle

rpcrt4

UuidCreate

kernel32

SetLastError GetProcessHeap SetEndOfFile FlushFileBuffers WriteConsoleW SetStdHandle DeleteFileA CopyFileA GetTickCount CloseHandle WaitForSingleObject CreateMutexA lstrlenA lstrcpyA FileTimeToSystemTime FileTimeToLocalFileTime FindClose FindFirstFileA GetFileAttributesA ReadFile CreateFileA FindNextFileA lstrcatA GetFullPathNameA RaiseException RtlUnwind EncodePointer DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW GetLastError HeapFree HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW CreateFileW GetCurrentThreadId InterlockedDecrement GetProcAddress Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetConsoleCP GetConsoleMode SetFilePointer HeapReAlloc LoadLibraryW LCMapStringW GetStringTypeW

shell32

SHFileOperationA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_020f1c06d0ce7224eb2186aea89cfa1e_elex_karagany_manuscrypt_rhadamanthys_stop

wininet

rpcrt4

kernel32

shell32

generic