Extracted

• • Target
    2026-06-01_2fb3361212c491d8cb6c7e511951081b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 4.9MB
  • SHA256 742dbdb5a8593a9b99ac485866157113513fb5e72bb2f5398cc52a6275fbba29
  • MD5 2fb3361212c491d8cb6c7e511951081b
  • SHA1 8419750b69f1f35fdb7338c4e72ffbdf702ce200
  • SHA512 09f903c9d5fbe42bbb6900f90874f1b312e921117ee1e868502d69ca5a26d4a6447c8f448e681590b803c0b3d3a86e8097ad3e09e574367add9227e59d198645
  • SSDEEP 98304:AWhfa98Qawb9UXqhqHZLLDBOqMeol1golprBR:A0fALa/qhkMeoTgolP
  • TLSH
    T1BB3633486087C071E8159A328C34DA745F767C768C6A5D4F3BC7BBBD3A30B96A90631B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2