2026-11-12_422af76733ab16c4be927d02d7648102_elex_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_422af76733ab16c4be927d02d7648102_elex_manuscrypt_rhadamanthys_stop
Size 130KB
Sample261113-e3lw1afw4w
SHA256 22d3dfdfae638d2f0204768204e8f83b0776080a7f8dced1b274952d516e1988
MD5 422af76733ab16c4be927d02d7648102
SHA1 ee656cb43e46ca365015fc34bf0c9f57ff1fbfe3
SHA512 456181fa3c401d9d8213028706562aab7b87027d8ad50291e4ecc7d9b5b408789764464a7f0a290bbedc4ab9a580a841ff07a0d94c50b8d9c17229e1cc0f30d3
SSDEEP 1536:Tnti7VsIdLt5COE85hLqhAj2JobRH4x/fSeqg56lhe5bPAF9vS72P7:727LMOVfLEoAVqY6lE5bP6vSc
TLSH
T194D38C117AC1C4B2C84A25324D55E765AA7DFD310FA1CAC733A82B6E4F713C19A3A2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-12_422af76733ab16c4be927d02d7648102_elex_manuscrypt_rhadamanthys_stop

.exe 130KB

2026-11-12_422af76733ab16c4be927d02d7648102_elex_manuscrypt_rhadamanthys_stop

IMPHASH 2701a122702d938047517cb2d8f5e559
SHA256 22d3dfdfae638d2f0204768204e8f83b0776080a7f8dced1b274952d516e1988
MD5 422af76733ab16c4be927d02d7648102
SHA1 ee656cb43e46ca365015fc34bf0c9f57ff1fbfe3
SHA512 456181fa3c401d9d8213028706562aab7b87027d8ad50291e4ecc7d9b5b408789764464a7f0a290bbedc4ab9a580a841ff07a0d94c50b8d9c17229e1cc0f30d3
SSDEEP 1536:Tnti7VsIdLt5COE85hLqhAj2JobRH4x/fSeqg56lhe5bPAF9vS72P7:727LMOVfLEoAVqY6lE5bP6vSc
TLSH
T194D38C117AC1C4B2C84A25324D55E765AA7DFD310FA1CAC733A82B6E4F713C19A3A2D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c9:f0:14:c0:b5:b7:4d:ee:fb:0f:9f:3a:f2:b5:92:15:a1:df:0c:ca:46:23:92:47:f8:20:88:45:72:10:9f:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Mar 6, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

71:81:59:e7:12:b2:12:c6:dc:2e:83:12:33:7a:2b:b8:e8:f0:72:33

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Mar 6, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:00:ec:1f:15:cf:66:07:33:22:2f:e6:80:c4:90:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2025 - Jul 21, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

30709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\gu6\Build\GUAssistComSvc\Release\GUAssistComSvc.pdb

kernel32

LoadResource FindResourceW LoadLibraryExW GetCommandLineW GetCurrentProcess EnterCriticalSection LeaveCriticalSection CreateFileA SizeofResource WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA MultiByteToWideChar FreeLibrary InterlockedDecrement InterlockedIncrement CreateEventW CreateThread GetModuleFileNameW GetCurrentThreadId Sleep lstrcmpiW GetModuleHandleW GetProcAddress SetEvent GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException lstrlenW WaitForSingleObject CloseHandle GetSystemInfo GetLocaleInfoA GetConsoleMode GetConsoleCP SetFilePointer WideCharToMultiByte IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount LoadLibraryA HeapSize HeapReAlloc VirtualAlloc IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW HeapAlloc HeapFree RtlUnwind ExitThread SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate VirtualFree QueryPerformanceCounter GetTickCount

user32

GetMessageW TranslateMessage LoadStringW CharNextW CharUpperW PostThreadMessageW DispatchMessageW MessageBoxW RegisterWindowMessageW DispatchMessageA GetMessageA MsgWaitForMultipleObjects PeekMessageW IsWindowUnicode

advapi32

RegisterServiceCtrlHandlerW RegEnumKeyExW ControlService DeleteService CreateServiceW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW OpenSCManagerW OpenServiceW CloseServiceHandle SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource StartServiceCtrlDispatcherW

ole32

CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoRegisterClassObject CoMarshalInterThreadInterfaceInStream CoTaskMemFree StringFromGUID2 CoCreateInstance CoGetInterfaceAndReleaseStream CoRevokeClassObject

oleaut32

SysAllocString SysStringLen SysFreeString LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi

shlwapi

PathFileExistsW PathIsNetworkPathW

mpr

WNetGetConnectionW WNetAddConnection2W

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_422af76733ab16c4be927d02d7648102_elex_manuscrypt_rhadamanthys_stop

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

mpr

generic