Extracted

• • Target
    2026-06-01_8fc83fe59c306a71795367e9a978d252_elex_rhadamanthys_stop
  • Size 4.8MB
  • SHA256 05ba4d9327386f1773fbeba74b8a42c0077c6427f83ef82ce98dec7676c2756e
  • MD5 8fc83fe59c306a71795367e9a978d252
  • SHA1 8582bc74f5a5c90e72df0dd24a090930ab7319e6
  • SHA512 534f68743ff6693632f77a3c14051e133dd9381a29ccaa11b2b1c96efb29e9ce401df041eff99a4ff79ccdab9ad29a66556c4a9da51fae15cae6528f5b2e1945
  • SSDEEP 98304:KR4RN8GgSK1ZvuHLnbKW8ejQMVCBkXawT67p:KRuZKzGrj85BY5Tk
  • TLSH
    T1D736331075D0E572C3699277C129CBB52AEEB4716F26928BAFC01F3A5F357D0AA31309
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Custom signature

    Detects PowerShell content designed to retrieve passwords from host

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables referencing many email and collaboration clients. Observed in information steale

  • Custom signature

    Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2