Extracted

• • Target
    2026-08-20_fa10d3450e54637ebef6d4cae001acc5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 1.4MB
  • SHA256 39224ee9eb3ab143b8c09bb1b624c5a8b2940889babd675fc02d3213c2ae55a6
  • MD5 fa10d3450e54637ebef6d4cae001acc5
  • SHA1 ea98d58fd5450a1d9cae19d598a71835b3c501d1
  • SHA512 938e65c68f3ae2d12aefe74092250e2f796014c620bc85885c6caeb2bce376d14550c60e47969bc801c5adfb21a5cf78cdb78f1eeed266e452e676dcc8345069
  • SSDEEP 12288:eEExb8aUh6ISxZsSpOhhou4WhM8b0JYYJY:wxboUIk8mJX
  • TLSH
    T1B465F110B280D472F41D81777671C3B34BB6BD752996AE8BBED40FB91B392D0AA1530B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverycryptbotspywarestealer

  • CryptBot payload

  • Family: CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2