2026-11-11_28e2c8ff32d606ff3b85295533fac9da_amadey_cloudeye_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

General

Target
2026-11-11_28e2c8ff32d606ff3b85295533fac9da_amadey_cloudeye_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop
Size 2.1MB
Sample261113-sr4vbsc14y
SHA256 36133b8c60c9fa96d37c7a7564685d041310e8e57454915b046fa8b421f8e34d
MD5 28e2c8ff32d606ff3b85295533fac9da
SHA1 017a1251e49fa2b63da687006617af1c0fd309e4
SHA512 959776a8523674de26568dead4ffc72c923107a45a3b2f4c8528d68482d84fa10a1c9c308881ec6f0fe49766244497da0888f23f866425d2cab4aabd289a7b25
SSDEEP 49152:4wBuaeqr4+L4Bp8a2H0zJ+1IlI1puknltEJNIqtky9G+lioW:4auIofrwsYpHyJtkyBK
TLSH
T1EAA523C13150A471C8F876F155AAA71229F57EA24AE190AF33F03F371872693CD27A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_28e2c8ff32d606ff3b85295533fac9da_amadey_cloudeye_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

2026-11-11_28e2c8ff32d606ff3b85295533fac9da_amadey_cloudeye_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

.exe 2.1MB

2026-11-11_28e2c8ff32d606ff3b85295533fac9da_amadey_cloudeye_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

IMPHASH acf1221c7644e4c77dec15ad33cbeed9
SHA256 36133b8c60c9fa96d37c7a7564685d041310e8e57454915b046fa8b421f8e34d
MD5 28e2c8ff32d606ff3b85295533fac9da
SHA1 017a1251e49fa2b63da687006617af1c0fd309e4
SHA512 959776a8523674de26568dead4ffc72c923107a45a3b2f4c8528d68482d84fa10a1c9c308881ec6f0fe49766244497da0888f23f866425d2cab4aabd289a7b25
SSDEEP 49152:4wBuaeqr4+L4Bp8a2H0zJ+1IlI1puknltEJNIqtky9G+lioW:4auIofrwsYpHyJtkyBK
TLSH
T1EAA523C13150A471C8F876F155AAA71229F57EA24AE190AF33F03F371872693CD27A5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

12687

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\src\clients\clients\downloader\Release\downloader.pdb

kernel32

GetModuleFileNameW FindResourceW LoadResource LockResource SizeofResource GetTempPathW GetTempFileNameW CreateProcessW WaitForSingleObject CloseHandle LCMapStringW GetStringTypeW GetProcessHeap SetEndOfFile HeapReAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryW GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetFilePointer MultiByteToWideChar ReadFile WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetProcAddress GetModuleHandleW ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep HeapSize CreateFileW SetStdHandle FlushFileBuffers WriteConsoleW

user32

wsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_28e2c8ff32d606ff3b85295533fac9da_amadey_cloudeye_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop

kernel32

user32

generic