Extracted

• • Target

    2025-04-24_b8dede8ee6902a16e06065382f3fc137_amadey_elex_karagany_rhadamanthys_smoke-loader

  • Size

    14.4MB

  • MD5

    b8dede8ee6902a16e06065382f3fc137

  • SHA1

    2d161f157c7aa6e99ae75d159052a612ed1402bf

  • SHA256

    849b95f6d1ab456325666215cea20f648a5ee67d190f5beabbd06e03f0e0b9f3

  • SHA512

    e7df2a5e3ee65f8bdd0122ff178a0e3c43d94c0b3f657dd1b0ebfe4c858252fde081f7e8978719fecb0d7659d996ccd0a3a7177886653db18d382f3b354d7f2b

  • SSDEEP

    6144:+8CHoLztEhfDI8KGNcFwH4wXIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII4:+8CHoLOhf0DGNc

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2