2026-10-28_51ff06247e252b57ad502a66bad0e638_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

General

Target
2026-10-28_51ff06247e252b57ad502a66bad0e638_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop
Size 281KB
Sample261030-e9l6cav1bt
SHA256 eb30df0db7c623263ce2bca08a17a4c1670d3bfb8fa1468d8ca943605dc20b0d
MD5 51ff06247e252b57ad502a66bad0e638
SHA1 91e5dffc74b5ed66f1b93b03b082505358e2964d
SHA512 1859b714cbd2c18fe3efc8b0f94799979a05a64ff44723d41f7095f40a46fee4e64c10d015633042784d17a8d72008f5ae1a6df6c7ff759959b6c94dc9c41fcd
SSDEEP 6144:AVMescdXhjBCU7LDb2UmawxunAznBIOGN2Ei5/pm:Amg/jcU7LDaUmaeuAFq+
TLSH
T12C54D02232F0D032D6F779704A75ABA45EBFB4336BB5C14F264907AA1F616C08A31717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_51ff06247e252b57ad502a66bad0e638_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-28_51ff06247e252b57ad502a66bad0e638_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

.exe 281KB

2026-10-28_51ff06247e252b57ad502a66bad0e638_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

IMPHASH 30936e8d9e5d5187e522081fcb7fd58c
SHA256 eb30df0db7c623263ce2bca08a17a4c1670d3bfb8fa1468d8ca943605dc20b0d
MD5 51ff06247e252b57ad502a66bad0e638
SHA1 91e5dffc74b5ed66f1b93b03b082505358e2964d
SHA512 1859b714cbd2c18fe3efc8b0f94799979a05a64ff44723d41f7095f40a46fee4e64c10d015633042784d17a8d72008f5ae1a6df6c7ff759959b6c94dc9c41fcd
SSDEEP 6144:AVMescdXhjBCU7LDb2UmawxunAznBIOGN2Ei5/pm:Amg/jcU7LDaUmaeuAFq+
TLSH
T12C54D02232F0D032D6F779704A75ABA45EBFB4336BB5C14F264907AA1F616C08A31717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

24879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForMultipleObjectsEx IsValidLocale ReadConsoleInputA GetThreadSelectorEntry ReadFileScatter GetCompressedFileSizeA GetProcAddress VirtualProtectEx LoadLibraryA LocalAlloc SetConsoleTitleW FindActCtxSectionStringA CancelIo GetCPInfoExA WinExec CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP GetPrivateProfileStringW FindCloseChangeNotification SetUnhandledExceptionFilter _llseek GetModuleHandleA lstrlenA WriteConsoleA CloseHandle GetCommandLineA GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer

user32

GetMonitorInfoA CountClipboardFormats ChangeDisplaySettingsA mouse_event IsWindow OpenDesktopW

advapi32

ReportEventW StartServiceA RegCreateKeyW GetUserNameW ConvertToAutoInheritPrivateObjectSecurity

msimg32

TransparentBlt

Name

.text

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

27KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

prirjyz

Size

103KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_51ff06247e252b57ad502a66bad0e638_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

msimg32

generic