Extracted

• • Target
    2026-06-01_0273d480df8e8265eb03bd7c6751211a_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 4.8MB
  • SHA256 a05c21c073cc899f20acaee8520c2dce8a8a187e470ecc10549bd8d30b3a742f
  • MD5 0273d480df8e8265eb03bd7c6751211a
  • SHA1 0247dc72dc04d495f58f3ce98d57cd7ee6033d67
  • SHA512 f95201163205ef676fe32b650b54dec46ee4fe3ff06ac820719f322edced2122274ea43073e80cb9573bc9e0344c2ce2e7fd97de120ad1a59277d456dc4f74be
  • SSDEEP 98304:Ty8xTfVj6rNK+xA8N1oDe/cqkrwjQ7gcPrU3VEG/NeCYyQwm/8xSA3YfQQuJ:u8xpjYKGZNeacqSwjQZPrU36yK8Do
  • TLSH
    T1A13633113792EE36C44FF1728890FB7ADB39787119D3550B5EBA36BD2E180D0879622B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2