2026-10-31_19e0cc26678c2576bb3cb599128d20b5_amadey_elex_manuscrypt_ramnit_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_19e0cc26678c2576bb3cb599128d20b5_amadey_elex_manuscrypt_ramnit_rhadamanthys_smoke-loader_stop
Size 144KB
Sample261031-te14caet5k
SHA256 9b76843103c6fe32e1fb303ccd0315a766ef83f1375f165b2c0fd5d6edf67d83
MD5 19e0cc26678c2576bb3cb599128d20b5
SHA1 47f53339acad7b91d1b33edabe9d74f52d2ea5cc
SHA512 ce4396a1528ecdf44c7a70bdd067808ea161e7f4d42388e6be2f51758ce3424637a1147b1880e483cf26ef03e77de8ca240ff912fb2523c39ce60c027542ec90
SSDEEP 1536:NG6IcRZagbOlksYYnI/aKk9kku/7HIdCtHQM4N4deKWQTctWXOzObovacn/JkQlU:NhbD2RRusdCtHQLN4d1ctW+C8yccAEZ
TLSH
T1D0E3AE263993C4B3E84604358659EBC29B7F7C0377A7A0EFFF54064E2D912D44A26AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_19e0cc26678c2576bb3cb599128d20b5_amadey_elex_manuscrypt_ramnit_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-31_19e0cc26678c2576bb3cb599128d20b5_amadey_elex_manuscrypt_ramnit_rhadamanthys_smoke-loader_stop

.exe 144KB

2026-10-31_19e0cc26678c2576bb3cb599128d20b5_amadey_elex_manuscrypt_ramnit_rhadamanthys_smoke-loader_stop

IMPHASH bff60b9772d89215ecfbc7ee7304b5c9
SHA256 9b76843103c6fe32e1fb303ccd0315a766ef83f1375f165b2c0fd5d6edf67d83
MD5 19e0cc26678c2576bb3cb599128d20b5
SHA1 47f53339acad7b91d1b33edabe9d74f52d2ea5cc
SHA512 ce4396a1528ecdf44c7a70bdd067808ea161e7f4d42388e6be2f51758ce3424637a1147b1880e483cf26ef03e77de8ca240ff912fb2523c39ce60c027542ec90
SSDEEP 1536:NG6IcRZagbOlksYYnI/aKk9kku/7HIdCtHQM4N4deKWQTctWXOzObovacn/JkQlU:NhbD2RRusdCtHQLN4d1ctW+C8yccAEZ
TLSH
T1D0E3AE263993C4B3E84604358659EBC29B7F7C0377A7A0EFFF54064E2D912D44A26AB1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Project\手游频道\InstallDriverX64\release\InstallDriverX64.pdb

newdev

UpdateDriverForPlugAndPlayDevicesW

kernel32

CloseHandle CreateNamedPipeW WaitNamedPipeW TerminateThread ConnectNamedPipe DisconnectNamedPipe ReadFile WriteFile CreateThread ExitProcess GetModuleFileNameW FreeConsole WideCharToMultiByte Sleep OutputDebugStringW GetLastError FindFirstFileW CreateFileW SetHandleCount HeapAlloc HeapFree GetVersionExA GetProcessHeap RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetProcAddress GetModuleHandleA GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA FlushFileBuffers

user32

IsWindow GetWindowTextW PostMessageW EnumChildWindows FindWindowW FindWindowExW

advapi32

CheckTokenMembership SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid FreeSid

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_19e0cc26678c2576bb3cb599128d20b5_amadey_elex_manuscrypt_ramnit_rhadamanthys_smoke-loader_stop

newdev

kernel32

user32

advapi32

shell32

generic