Extracted

• • Target

    2025-04-24_0b6ecf6993605d4c07430ff67c03e856_elex_rhadamanthys_smoke-loader

  • Size

    10.6MB

  • MD5

    0b6ecf6993605d4c07430ff67c03e856

  • SHA1

    e85e24e74589054fc35e1becc77a3de2cdce6f66

  • SHA256

    832208110497294f8ebdf03891c54bef7f24f9d363628403c20579b0a7a83eb6

  • SHA512

    edcd4f3007d6a46ec37aa961c07237f6ab4cf10332540ca2e10cc198acc072a42a3b2e3342aaefd694a7f683afc9b7bfbc3f49b95ce3fca9835625af44062876

  • SSDEEP

    49152:ZqL7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7ID:Z

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2