Extracted

• • Target
    2026-06-01_090cca1a65e5de095961c33436dc7179_elex_manuscrypt_rhadamanthys_stop
  • Size 4.8MB
  • SHA256 91800fc4ea53de09fc0bd545feea39858689cbb18d2958e874c567a74e58afc4
  • MD5 090cca1a65e5de095961c33436dc7179
  • SHA1 e48e28906b8f4bb17d714b73a4e8e49fe2a30b2f
  • SHA512 972a19d0e6ef20c7007b9826a95ce21c4115382db1546fc87382bd0b4d88d55cd8d89dab6560fad1d1884d74c3ff6898ce2445d1f298fe3f01e3b98fa6d8f226
  • SSDEEP 98304:41xvv0ZiU+NOzBwUPQdu2T1ctLANB1BykMUfzR:41ZIRAK+T1caNDPhb
  • TLSH
    T1E33633E1A023E433CF55047481C49AE4B1ADA936EB6251072AB52B7BBF382F1357E15F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2