Extracted

• • Target

    2025-04-04_3de07fc37b1ec7bcc81605a734e3d1d4_amadey_rhadamanthys_smoke-loader

  • Size

    11.1MB

  • MD5

    3de07fc37b1ec7bcc81605a734e3d1d4

  • SHA1

    a8e4cc3a1ae14ad10186c64ed8a9502093f05967

  • SHA256

    25b5a02112f637745bdafc3cabfac046a51e4a22c94a2fdefbc73a4fda4d1d2d

  • SHA512

    f479165819a3cf589cf411cabc1da93f5037214fc3c417bb8a76c00b3c94d87126a4332cb557e4578cc6fc131b11c0babcda8efc6249938093e016adcaab92c1

  • SSDEEP

    6144:kWJVsv5VHd74XANXpZu0wn81Nm89qmrHTL8h6ly5bdnG:RVsvb6XANXpgV67qE/tlyvG

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1