2026-11-11_2dffa36016bf3fee0012db51f4b1eaa8_elex_karagany_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_2dffa36016bf3fee0012db51f4b1eaa8_elex_karagany_manuscrypt_rhadamanthys_stop
Size 168KB
Sample261113-sc2rescy8v
SHA256 57a68742970e18c4ccae164bdce7e0d2b47b39dc3cde708e891a081f5f6cd2e4
MD5 2dffa36016bf3fee0012db51f4b1eaa8
SHA1 fb6c93ab51a8957d79595bc783bd09a5d7bdfbbc
SHA512 b9c988f61b0a3786c59534d7573c1ddc4888ecc6159e51f3380b0cf537fd05498baa21751c00755bebd8d3a3b49b90c2737a81a62c2214743f3c5e5d09008dd8
SSDEEP 3072:FKC7k5qlKZdgYaah+cB2tq4Yb+SnrDHzwW3kIff3eFoa:FnO2ahzCeDTw831a
TLSH
T16AF39C1036D1C175E8B206314DB4AB925A3EFE364B70A9CBF7D406AE58706C19A36B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_2dffa36016bf3fee0012db51f4b1eaa8_elex_karagany_manuscrypt_rhadamanthys_stop

File Explorer

2026-11-11_2dffa36016bf3fee0012db51f4b1eaa8_elex_karagany_manuscrypt_rhadamanthys_stop

.exe 168KB

2026-11-11_2dffa36016bf3fee0012db51f4b1eaa8_elex_karagany_manuscrypt_rhadamanthys_stop

IMPHASH d32fbb2655af627f75f897875197410a
SHA256 57a68742970e18c4ccae164bdce7e0d2b47b39dc3cde708e891a081f5f6cd2e4
MD5 2dffa36016bf3fee0012db51f4b1eaa8
SHA1 fb6c93ab51a8957d79595bc783bd09a5d7bdfbbc
SHA512 b9c988f61b0a3786c59534d7573c1ddc4888ecc6159e51f3380b0cf537fd05498baa21751c00755bebd8d3a3b49b90c2737a81a62c2214743f3c5e5d09008dd8
SSDEEP 3072:FKC7k5qlKZdgYaah+cB2tq4Yb+SnrDHzwW3kIff3eFoa:FnO2ahzCeDTw831a
TLSH
T16AF39C1036D1C175E8B206314DB4AB925A3EFE364B70A9CBF7D406AE58706C19A36B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\YqsGuard\Release\YqsGuard.pdb

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

SysAllocString VariantClear VariantInit SysFreeString SysAllocStringLen

advapi32

AdjustTokenPrivileges RegOpenKeyExW CryptGenRandom LookupPrivilegeValueW RegQueryValueExW CryptReleaseContext CryptAcquireContextW OpenProcessToken RegCloseKey

user32

TranslateMessage ExitWindowsEx GetMessageW DispatchMessageW

kernel32

LCMapStringW HeapReAlloc SetStdHandle WriteConsoleW ResumeThread GetStringTypeW SetFilePointerEx GetConsoleMode GetConsoleCP WideCharToMultiByte CreateMutexW MapViewOfFile UnmapViewOfFile CreateProcessW InterlockedIncrement InterlockedDecrement GetCurrentProcess CreateDirectoryW WaitForSingleObject GetModuleHandleW GetTickCount GetSystemTimeAsFileTime GetPrivateProfileStringW WriteFile QueryFullProcessImageNameW OpenProcess Thread32First Sleep CopyFileW FreeConsole Wow64DisableWow64FsRedirection GetExitCodeProcess Wow64RevertWow64FsRedirection GetFileAttributesW TerminateProcess Thread32Next GetModuleFileNameW CreateFileW GetTempPathW InterlockedExchange GetLastError SetLastError GetProcAddress GetLocalTime Process32FirstW OpenThread CreateFileMappingW Process32NextW OpenFileMappingW CreateToolhelp32Snapshot CloseHandle GetWindowsDirectoryW DeleteFileW GetCurrentProcessId FlushFileBuffers GetVolumeInformationW CreateThread LoadLibraryW OutputDebugStringW LoadLibraryExW LocalFree GetCommandLineW EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent RaiseException RtlUnwind GetCurrentThreadId ExitProcess GetModuleHandleExW MultiByteToWideChar GetStdHandle GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapSize HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree HeapAlloc EnterCriticalSection LeaveCriticalSection

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_2dffa36016bf3fee0012db51f4b1eaa8_elex_karagany_manuscrypt_rhadamanthys_stop

ole32

oleaut32

advapi32

user32

kernel32

generic