Extracted

• • Target

    2025-04-24_df9404a73b9e42cabe27dbc58b257e76_amadey_elex_rhadamanthys_smoke-loader

  • Size

    12.1MB

  • MD5

    df9404a73b9e42cabe27dbc58b257e76

  • SHA1

    13ee19544b2a68e2b29d31dbe0c14ac61e0df6d6

  • SHA256

    70b15a2649437e3d5dd99038dc961bc4b145af1a3c6fabe8fc1d10bde9ce4800

  • SHA512

    5b36a4b4711b14aaf5ff34b475d4f07a8e54cff2f456273ad7422ace2318223089bafb3c46ba3f2e42879e5ca59c15f7e68516291c1638b2cf4722cd2361b340

  • SSDEEP

    3072:1KHmHkEYjlVm4BNvJ5mhXReV46dFiI9yM4M7gG2ck+Dy:wMYjfmgMhXR8TiI/L7D2cRy

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2