Extracted

• • Target

    2025-03-30_1af7c14f03c0f97e84866762d3975796_amadey_smoke-loader

  • Size

    10.6MB

  • MD5

    1af7c14f03c0f97e84866762d3975796

  • SHA1

    7049d730600dc4e28a8859e835d701e365d0e83a

  • SHA256

    35bc3d4b58223b892a1e97468a1a201d70313fb8eb0493fd8dc84d4676220b57

  • SHA512

    07f3300958da25fbb02d2e51887fc0cf9b8b578d24cd4de1b6d524b2ad3380d91728dd16d618a2c19992753b2df795e77caf4b2fb59d3e9336ab33a053992324

  • SSDEEP

    6144:T7aBkOsUh6TFWAbjG+jTD7fksRUrz8KFxVsGEp:a3sUhfAvGETD7f2XhFDstp

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2