Extracted

• • Target

    2025-03-30_593ab1704817d65976eb215ca605963a_amadey_rhadamanthys_smoke-loader

  • Size

    11.8MB

  • MD5

    593ab1704817d65976eb215ca605963a

  • SHA1

    f7b0316979e796492264845dfed3b2aa0542ecaf

  • SHA256

    77a9cba9f3c3051f71c90a4d498953be987602f4dc9bb5b2449a43c3272d1f2e

  • SHA512

    b262494d3d1c0094de0ba1cf2eec8d55abdb0fac2d14d3f1b7c69c0a561d179fc8e27a0fc9616d71636abd03a74ce618ec3fd92cc168833441ae91cbcd6d7984

  • SSDEEP

    12288:nEMv9cfEtUy9UoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUoUP:n3usFK

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2