Extracted

• • Target
    2026-06-01_64073883426ec69184b0ba0847876b03_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 4.8MB
  • SHA256 5dfddcf08c62318edd0ae622aab63b446dfbf8bf704429a5b36793c61cb52024
  • MD5 64073883426ec69184b0ba0847876b03
  • SHA1 1b31812e2e5863ff5501745d559d5cdd4daaec80
  • SHA512 1545adeae2e720313f59e7debcf9f321c28097b4987f1bebc696c2b08b509437f138d4e699386dde0ebed8215e5129a300961347086fbbb915f73b9188af3740
  • SSDEEP 98304:AaAxkPlZPtPRs9zEnmrYYJQUu6nmAi9wUTtjskyQM/k3Mjb3:AaiAVO1rJE6oeMtj7lMk8j7
  • TLSH
    T1F7363320B280F932D16B113A85B0C7311E7EBC77A9256C9B4ED04B3EDF782E5A6B550D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2