2026-11-03_b3361552fa0918180e30023c6f2c9287_elex_floxif_hijackloader_karagany_manuscrypt_maze_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_b3361552fa0918180e30023c6f2c9287_elex_floxif_hijackloader_karagany_manuscrypt_maze_rhadamanthys_stop
Size 298KB
Sample261104-mdh3tabw7p
SHA256 851d0cf0c58db9d1047e8722ed197a9cfa8fddb68302e7fad1e551956dcf8718
MD5 b3361552fa0918180e30023c6f2c9287
SHA1 8083cfaa3dd728a32e733742fc7265a6cfe5d7d4
SHA512 7399b5fbb8999333b5d55a94ddbfaec2220372942e7635788bf95067c2222f508ce30b7bcb8c2ab1e595cb6c3bb94c9a2ba67aff4889a246ca7529343193256d
SSDEEP 3072:4LsLSDR6jw9QEdkOKjXvDRaxP6J1oy0Vxkxm2lQBV+UdE+rECWp7hKBdQzsb:4IODR+j1hhM3BV+UdvrEFp7hKh
TLSH
T17A54582030A243ABD751373C3277D630C9A5ADEA27B647F772C4A0C509FA6C1E76661E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-03_b3361552fa0918180e30023c6f2c9287_elex_floxif_hijackloader_karagany_manuscrypt_maze_rhadamanthys_stop

File Explorer

2026-11-03_b3361552fa0918180e30023c6f2c9287_elex_floxif_hijackloader_karagany_manuscrypt_maze_rhadamanthys_stop

.exe 298KB

2026-11-03_b3361552fa0918180e30023c6f2c9287_elex_floxif_hijackloader_karagany_manuscrypt_maze_rhadamanthys_stop

IMPHASH 139b1c8c3ca134ca6f15404b739230ea
SHA256 851d0cf0c58db9d1047e8722ed197a9cfa8fddb68302e7fad1e551956dcf8718
MD5 b3361552fa0918180e30023c6f2c9287
SHA1 8083cfaa3dd728a32e733742fc7265a6cfe5d7d4
SHA512 7399b5fbb8999333b5d55a94ddbfaec2220372942e7635788bf95067c2222f508ce30b7bcb8c2ab1e595cb6c3bb94c9a2ba67aff4889a246ca7529343193256d
SSDEEP 3072:4LsLSDR6jw9QEdkOKjXvDRaxP6J1oy0Vxkxm2lQBV+UdE+rECWp7hKBdQzsb:4IODR+j1hhM3BV+UdvrEFp7hKh
TLSH
T17A54582030A243ABD751373C3277D630C9A5ADEA27B647F772C4A0C509FA6C1E76661E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

de:77:df:18:7d:85:a8:6c:97:34:0d:68:37:23:6c:51:5d:62:88:34

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Jul 5, 2023

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

41:8a:d3:82:6f:9c:74:cc:ef:8e:e6:fd:26:52:b5:dc:ee:50:42:59:15:2e:1d:09:29:fa:37:3f:6a:1b:b9:6a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

Chains

Jul 5, 2023

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=RAONWIZ Inc.,O=RAONWIZ Inc.,L=Seocho-gu,ST=Seoul,C=KR

Serial Number

0d:58:c5:e1:07:2e:f8:aa:a4:7c:24:7c:e8:d1:12:7b

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 6, 2021 - May 22, 2024

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

25197

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\7.Works\RAONK\K.Svc\bin\raonk.svc.pdb

kernel32

GetCurrentProcess TerminateProcess CopyFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource WTSGetActiveConsoleSessionId LoadResource FindResourceW FindResourceExW InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteCriticalSection FlushFileBuffers WriteConsoleW SetStdHandle SetFilePointerEx GetModuleFileNameW DeleteFileW SetFileAttributesW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar LocalFree FormatMessageW SetThreadUILanguage SetThreadLocale Process32NextW Process32FirstW CreateToolhelp32Snapshot GetShortPathNameW GetTickCount Sleep SetEvent CloseHandle WaitForSingleObject CreateThread CreateEventW GetLastError FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW VerifyVersionInfoW VerSetConditionMask LockResource GetConsoleMode GetConsoleCP LCMapStringW GetStringTypeW LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetFileType WriteFile GetStdHandle GetStartupInfoW TlsFree TlsSetValue IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineW RtlUnwind ExitProcess GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue CreateFileW

user32

wsprintfW

advapi32

ControlService QueryServiceStatus DeleteService OpenServiceW CloseServiceHandle UnlockServiceDatabase ChangeServiceConfig2W LockServiceDatabase CreateServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CreateProcessAsUserW DuplicateTokenEx GetTokenInformation DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

shell32

SHGetFolderPathW

ole32

OleInitialize OleUninitialize

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_b3361552fa0918180e30023c6f2c9287_elex_floxif_hijackloader_karagany_manuscrypt_maze_rhadamanthys_stop

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

userenv

version

wtsapi32

generic