Extracted

• • Target
    2026-06-02_fa82e9320213516c5f28af1ab6c27ea2_elex_rhadamanthys_stop
  • Size 4.9MB
  • SHA256 8f14fb0193628a06b0ffdbf3eee3ae2c6ba79b31441faea0d9dc4160c0631b4e
  • MD5 fa82e9320213516c5f28af1ab6c27ea2
  • SHA1 4ccccbb130cd160b57c7209c8da41d59d9bcb7e8
  • SHA512 25ea586f05c2171f457c933f28108858f9401e73842cf13fbf2b2d77a5e892aef8d9b4224deb8726dc7f84e1f2f9323b01176382a838662f7d729dde9af65aa3
  • SSDEEP 98304:ld5Es5XscQeuVjB5VPGC3sRYARpIy7aG0tzzAn1z/g:ld5zXscQDVv1GVYAFa5xAF/g
  • TLSH
    T1813633D13790CA72C11622BAB484CBB99FB8783497953BCB3AF8167D1F196D21A35307
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2