Extracted

• • Target

    2025-04-24_eed2f94d9ebedc6dd626900fd474a73e_amadey_elex_rhadamanthys_smoke-loader

  • Size

    14.6MB

  • MD5

    eed2f94d9ebedc6dd626900fd474a73e

  • SHA1

    63993c049146bb8947b0a1b39f7972c8a08a893f

  • SHA256

    6452d643a6385e8f03dfdf041ffa8a37eb0bbb7c59c42bd6441b725cbe902108

  • SHA512

    c9c6736351cbdd060bc9dd802491ca4642c084265f93de6720fd3000a40516fcc85af77188f37541e89ea18529b4355c0191b7c02b0cbe7f64c208e9fcf754f5

  • SSDEEP

    393216:+IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIn:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2