2026-11-09_2bb1ad9dc2284b893ce28ad56dc76a5b_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_2bb1ad9dc2284b893ce28ad56dc76a5b_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
Size 282KB
Sample261110-31ddvacf66
SHA256 94ae29a3463b2a9bfe5cdd69ca118368ed347b15f9b6a3a304c14532a912796b
MD5 2bb1ad9dc2284b893ce28ad56dc76a5b
SHA1 a4a4dd5091ada5b37df328721c2cc99cd7c1d2c6
SHA512 7194f85fe71398f681ac57306c9d65f59200fa8f07495dbee7ba328c153d09069af836f706c5fba9f7182957377d43f592a0223ff3fee4067e2979c838541ffd
SSDEEP 3072:HeDHVJeceI2F+A4Gr0u8IVbb/UK7q4X6TO:yHV8ceIC4s0uR/iI6T
TLSH
T1B5544B51B522D222E1B10A7FCC6AC5FB89683F21AD249757BEDCBF2F37B1540844B162
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_2bb1ad9dc2284b893ce28ad56dc76a5b_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

File Explorer

2026-11-09_2bb1ad9dc2284b893ce28ad56dc76a5b_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 282KB

2026-11-09_2bb1ad9dc2284b893ce28ad56dc76a5b_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH d8ab064d4af1cc35d9d9b3e36ce168cd
SHA256 94ae29a3463b2a9bfe5cdd69ca118368ed347b15f9b6a3a304c14532a912796b
MD5 2bb1ad9dc2284b893ce28ad56dc76a5b
SHA1 a4a4dd5091ada5b37df328721c2cc99cd7c1d2c6
SHA512 7194f85fe71398f681ac57306c9d65f59200fa8f07495dbee7ba328c153d09069af836f706c5fba9f7182957377d43f592a0223ff3fee4067e2979c838541ffd
SSDEEP 3072:HeDHVJeceI2F+A4Gr0u8IVbb/UK7q4X6TO:yHV8ceIC4s0uR/iI6T
TLSH
T1B5544B51B522D222E1B10A7FCC6AC5FB89683F21AD249757BEDCBF2F37B1540844B162
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27303

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Matter\son\Family\duck\Name\Reach\let\Create\logAnd.pdb

kernel32

HeapCreate GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetStdHandle QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc WriteFile ExitProcess IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree DecodePointer TlsSetValue TlsGetValue TlsAlloc EncodePointer HeapFree GetLastError HeapAlloc HeapSetInformation GetCommandLineW RaiseException RtlUnwind GetModuleHandleW GetProcAddress VirtualAlloc VirtualFree ResetEvent CreateDirectoryW DeleteCriticalSection CreateFileW SetEndOfFile GetFileSize CloseHandle LoadLibraryW WaitForSingleObject DeviceIoControl GetTickCount DeleteFileW CopyFileW GetStartupInfoW CreateProcessW Sleep

ole32

CoRevokeClassObject CoUninitialize OleUninitialize OleInitialize CoInitialize

user32

ScreenToClient SystemParametersInfoW ClientToScreen RegisterClassExW GetWindowTextLengthW SetForegroundWindow CheckRadioButton SendDlgItemMessageW GetClipboardData SendMessageW SetClipboardData FindWindowW ShowWindow EnumChildWindows GetDC GetClassNameW UpdateWindow GetMessagePos GetMessageTime DrawTextW GetWindowTextW GetMenuItemInfoW LockWindowUpdate GetDlgCtrlID GetSystemMenu

gdi32

CreateBitmap SetBkColor SetTextColor GetClipBox GetCharWidthW DPtoLP CreateDCW GetObjectW DeleteDC BitBlt

comctl32

ImageList_Create ImageList_GetImageInfo ImageList_GetImageCount ImageList_EndDrag ImageList_DragEnter

comdlg32

GetSaveFileNameW GetOpenFileNameW ChooseColorW

ws2_32

WSACleanup WSAStartup connect accept closesocket bind socket WSAConnect WSACreateEvent WSAGetOverlappedResult WSASocketW WSAWaitForMultipleEvents

wininet

InternetOpenW InternetSetOptionW InternetConnectW InternetReadFile HttpOpenRequestW HttpSendRequestW HttpQueryInfoW FtpOpenFileW InternetCloseHandle

shlwapi

PathFindFileNameW PathIsNetworkPathW PathIsFileSpecW

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyW RegOpenKeyExW AllocateAndInitializeSid FreeSid OpenProcessToken StartServiceCtrlDispatcherW InitializeSecurityDescriptor RegEnumKeyW RegSetValueExW RegisterServiceCtrlHandlerW SetSecurityDescriptorDacl SetServiceStatus LookupPrivilegeValueW OpenSCManagerW OpenServiceW OpenThreadToken QueryServiceStatus RegCreateKeyExW RegOpenKeyW SetSecurityDescriptorGroup SetSecurityDescriptorOwner

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_2bb1ad9dc2284b893ce28ad56dc76a5b_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

ole32

user32

gdi32

comctl32

comdlg32

ws2_32

wininet

shlwapi

advapi32

generic