Extracted

• • Target

    2025-03-30_45a0b1223df4e45c3b25f7f55f2fc20f_amadey_rhadamanthys_smoke-loader

  • Size

    11.9MB

  • MD5

    45a0b1223df4e45c3b25f7f55f2fc20f

  • SHA1

    8dba221e145c95242b33964f42c14abe8e0e79c0

  • SHA256

    aaf99fd53b0e20e1495fa5f8e1fb0bd060a8324d4c6156e4c0b22d8393495bd6

  • SHA512

    0c7abe8ddf8050ebb1c117c58abf7bbfc73678b4126536f9fb9640a550f7cf6f54f74cb76d669033056c29e6daef041ae19cb2b666b901d2faaeb91898d07609

  • SSDEEP

    12288:NkcLVukCo8F8JeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMO:NkkYkCoDS

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2