2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 1.3MB
Sample261110-klbbtseb48
SHA256 8a21ad7f47c517fc4484651833b73e82bf8456e9dd99187be0774f4bae2a289d
MD5 35e5fb3b57c632ccbc4065607bd91d26
SHA1 aa88dda5a4a4ccc4b6acd2a36281695be286d62a
SHA512 e284e22d00981324cab67673ac42a04ed8d0e4b1063805a2c37d02f3fc8bf8ac140c9a9f514cf921ec29990e9ca7c595e489d5dc98943efd2e70cdc510e83962
SSDEEP 12288:1YwbyPLlwVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:1lbyposqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E551226B2C581B6D46314758AB8F569981FBF224F3504C37B993A7FAEB15C44F38223
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop

.exe 1.3MB

2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 2d383ba2e8638b99c92c045b416c4944
SHA256 8a21ad7f47c517fc4484651833b73e82bf8456e9dd99187be0774f4bae2a289d
MD5 35e5fb3b57c632ccbc4065607bd91d26
SHA1 aa88dda5a4a4ccc4b6acd2a36281695be286d62a
SHA512 e284e22d00981324cab67673ac42a04ed8d0e4b1063805a2c37d02f3fc8bf8ac140c9a9f514cf921ec29990e9ca7c595e489d5dc98943efd2e70cdc510e83962
SSDEEP 12288:1YwbyPLlwVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:1lbyposqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E551226B2C581B6D46314758AB8F569981FBF224F3504C37B993A7FAEB15C44F38223
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Jenkins\workspace\BuildStarship\trunk\PDFPreviewHandlerHost\PDFPreviewHandlerHost\Release\PDFPreviewHandlerHost.pdb

kernel32

LeaveCriticalSection GetModuleFileNameW InterlockedIncrement InterlockedDecrement FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW CloseHandle WaitForSingleObject EnterCriticalSection CreateThread CreateEventW GetCurrentThreadId SetEvent GetCommandLineW GetStringTypeW LCMapStringW WideCharToMultiByte IsValidCodePage lstrcmpiW GetModuleHandleW GetProcAddress DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException Sleep lstrlenW GetOEMCP GetACP GetCPInfo LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW IsProcessorFeaturePresent HeapSize HeapReAlloc SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcess TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapCreate GetStdHandle HeapAlloc HeapFree RtlUnwind EncodePointer DecodePointer HeapSetInformation GetStartupInfoW ExitProcess WriteFile

user32

CharNextW DispatchMessageW GetMessageW PostThreadMessageW CharUpperW TranslateMessage

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemFree CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoRevokeClassObject StringFromGUID2 CoAddRefServerProcess CoCreateInstance CoReleaseServerProcess CoRegisterClassObject

oleaut32

SysFreeString SysStringLen VarUI4FromStr LoadRegTypeLi LoadTypeLi SysAllocString UnRegisterTypeLi RegisterTypeLi

rpcrt4

IUnknown_Release_Proxy NdrOleAllocate NdrOleFree NdrStubForwardingFunction IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrCStdStubBuffer2_Release

Name

.text

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

51B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

generic