Extracted

• • Target

    2025-04-24_5dc22db2b2306ce727f53032b98808ba_elex_rhadamanthys_smoke-loader_stealc

  • Size

    12.5MB

  • MD5

    5dc22db2b2306ce727f53032b98808ba

  • SHA1

    5867bd0b0bf1e3258b435b5099e5bb858c84b51a

  • SHA256

    d9c1d78941dee81e433947006331d8c29ab494c8fdd612b3b90b3f69f1cf27e6

  • SHA512

    0e2283fa8e2bf5b7094d159767dc7d943f387d016e8ae5bf5cfea46b2e8e223692e5bf8b2318049dca928ae61b79ef86aec5ab054fe5f2382b7279d53f89ea1e

  • SSDEEP

    3072:G/rOyT6yvBOuL6vg693RPYQAzBSUGor5p3WbbwNfMAznojwVX/lIOxn:Gzv3vQuL6vg69BUv7r5ykNfXsER/5n

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2