Extracted

• • Target
    2026-06-11_bea934be389585d897ca11426a44adea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 4.9MB
  • SHA256 bffbacd64d0d86ef256dccef7c7f71b7362104781a7750fb28eec72310b74318
  • MD5 bea934be389585d897ca11426a44adea
  • SHA1 e389fc8da89263ae651f01149a7608c3c572435f
  • SHA512 644635b497331f5a93f6371dbdc439f864e718f2d8904e930382dd0ef19065a5174f032d14d06b3718459bdb87621c30305d034bc531c5b14fae5fa55c14059d
  • SSDEEP 98304:HuxUOVBHXeMuI9gPjH3BJHcecbbP/opXz36xV59AD4imfd3:HuxU03vCPzBdcHbbPaXu8Af
  • TLSH
    T1FF36331512D3C0B1D27466BA9815A1F98B0B7C79AD424F9BAFC033EE36392E1237D752
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects PowerShell content designed to retrieve passwords from host

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2