2026-11-01_8c37f53e0b9db1db540e8a5dd108cc18_cloudeye_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

General

Target
2026-11-01_8c37f53e0b9db1db540e8a5dd108cc18_cloudeye_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee
Size 1.1MB
Sample261102-sq6brsaz71
SHA256 002e20e4b47a7fc155ed68d92ab66c1a53c1189fde55779559af3716b3d1d1ec
MD5 8c37f53e0b9db1db540e8a5dd108cc18
SHA1 01ed142e626b96e451b3f581d316516bd752a25a
SHA512 fbd0ec1471ccdbbe1d1d3efae1f5d79fc2b4173122013e56f8415f4d2bd063ceb2df0c883b3379b7934bb39087c7a185fdf5ee935bedaf5945bd2b6978a272a4
SSDEEP 24576:KWAdBSOt5pufsTMGF+Vi4/wwk1L1sfby7DGCovSHjreCrm+2:KWkBZasfIwZszynGjvSH2CS+
TLSH
T1D23523113AC4C8B2E1A7193185F99BB64FBBF92147251ACF67D40A7E2F3C1D2863534A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_8c37f53e0b9db1db540e8a5dd108cc18_cloudeye_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2026-11-01_8c37f53e0b9db1db540e8a5dd108cc18_cloudeye_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

.exe 1.1MB

2026-11-01_8c37f53e0b9db1db540e8a5dd108cc18_cloudeye_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

IMPHASH dd58bdb6a238954b7c2c8aded32f779e
SHA256 002e20e4b47a7fc155ed68d92ab66c1a53c1189fde55779559af3716b3d1d1ec
MD5 8c37f53e0b9db1db540e8a5dd108cc18
SHA1 01ed142e626b96e451b3f581d316516bd752a25a
SHA512 fbd0ec1471ccdbbe1d1d3efae1f5d79fc2b4173122013e56f8415f4d2bd063ceb2df0c883b3379b7934bb39087c7a185fdf5ee935bedaf5945bd2b6978a272a4
SSDEEP 24576:KWAdBSOt5pufsTMGF+Vi4/wwk1L1sfby7DGCovSHjreCrm+2:KWkBZasfIwZszynGjvSH2CS+
TLSH
T1D23523113AC4C8B2E1A7193185F99BB64FBBF92147251ACF67D40A7E2F3C1D2863534A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

27266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\EvilGhost\Documents\Visual Studio 2010\Projects\TFS同步\项目\创建绑定程序\Release\BindingProgram.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeResource LoadResource WriteFile SizeofResource ReadFile CreateDirectoryA LockResource GetModuleFileNameA CloseHandle CreateFileW WriteConsoleW SetStdHandle WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress ExitProcess GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetStringTypeW GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc GetConsoleCP GetConsoleMode LoadLibraryW FlushFileBuffers

shell32

ShellExecuteA SHGetSpecialFolderPathA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_8c37f53e0b9db1db540e8a5dd108cc18_cloudeye_elex_mafia_manuscrypt_rhadamanthys_stop_tofsee

kernel32

shell32

generic