Extracted

• • Target
    2026-06-02_9083c37338edaf5f4fd9f7f38f527673_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 4.8MB
  • SHA256 14eb7430c265c607b20233c490e851acf6f84dc171a4c3fdd13305e347dfca98
  • MD5 9083c37338edaf5f4fd9f7f38f527673
  • SHA1 9212e1a409e7dbe7969c19e4d1538e16ac457ff4
  • SHA512 c040d37992e6c0b661352dcbc5f1213c0bc0b1b8ae5169b7ab81e480583dea6c7f0eb7af4009f12ff9a0086f257bc1164600271c20f6be61b3ec07e17a1aacfe
  • SSDEEP 98304:PqynP+wElEG8p++HCIJE4ojM0i9yF8T4Fx+l6C:P9nPwlDLIJcHoQU4FQ
  • TLSH
    T1163633287580C131C04F28354291D7BD4F6AB5A51317AFBBFBC8493E8F64BD28AA534E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2