Extracted

• • Target

    2025-03-30_36ba13f7b6dd4a1d2ffba1695c990bca_amadey_karagany_mafia_rhadamanthys_smoke-loader

  • Size

    10.9MB

  • MD5

    36ba13f7b6dd4a1d2ffba1695c990bca

  • SHA1

    c21b84141dddf4ce114452d600c54a4344734c84

  • SHA256

    083a33ce3a987a07edf0bb6f6632a3a9146e408863bb1bb66a734c1efd68777f

  • SHA512

    c685a98a97e88457c9b3da85d48bbc7e61ddf4413fc875697d0886f062e9dafa4bde53951e68a09adf4f57e0025449eebe7840fba1037096497cbb0cb5270b43

  • SSDEEP

    6144:5rpR8A6n7KzdbpQNU+yyYqrUdE05deEOxO:5rpjqm5lf+yyYVE0PWU

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2