Extracted

• • Target
    2026-08-19_53f51f42c52c37b3f2d1ea4384c3dfc4_amadey_elex_redline-stealer_rhadamanthys_stop_tofsee
  • Size 4.9MB
  • SHA256 9f1eecadab6484519615f7e0ac887934f06847e96718b0b05683feb990a33f08
  • MD5 53f51f42c52c37b3f2d1ea4384c3dfc4
  • SHA1 5196690000ee58273c64eebdc3434a51c50b6f1f
  • SHA512 2171dfae7575590d707d4d625cb049cc14c58c4305dd06f4747f584577cf97050a5b8610a9dcce99ecb822e165f08df4a433e91987f30489013f746e23f6eb58
  • SSDEEP 98304:ek2T1ncriHRAUajMWVzlz1Ib58uzOcUepWnLbSJt:MTOiHRAUIMu4iuz+it
  • TLSH
    T1B43633213193C471D260AA34CC24D2A55B32FC7365259E9F39F93B7E3F30692926972E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  banker3discoverydanabotspywarestealertrojan

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Custom signature

    Detects PowerShell content designed to retrieve passwords from host

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables referencing many email and collaboration clients. Observed in information steale

  • Custom signature

    Detects executables referencing many file transfer clients. Observed in information stealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2