Extracted

• • Target

    2025-03-28_3282f12ab10ce2ea3bdb07ea836b4f2e_amadey_rhadamanthys_smoke-loader

  • Size

    11.5MB

  • MD5

    3282f12ab10ce2ea3bdb07ea836b4f2e

  • SHA1

    c8852356850c23dcdf6d356212b63433e8996aeb

  • SHA256

    b188a4a8b0ba36f432612851f8e5629ffab553326c2295965051d0f4b4688746

  • SHA512

    f9f03c879a3debcdcf3f5e1959296d7a2a3decd1a0f57b8964958695604177f934da2063a6dde44d82699a78bf3b2115db7ae741bed1bcf2bb338095aa40178d

  • SSDEEP

    6144:92MDRs+9skCSisUPOdxJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJs:92y6eCSio0

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2