Extracted

• • Target

    2025-04-24_0ad9583352534446a769457e7045ea42_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

  • Size

    10.9MB

  • MD5

    0ad9583352534446a769457e7045ea42

  • SHA1

    2952fe57aec43bef36461adf82bd020c020fc0f0

  • SHA256

    ddebe39d5ad069b54d0ad18e59bbfb341ed5d25026d816e3331fce5f89a9c2bb

  • SHA512

    744396adcf0b77363b526cdeba8a82de8a5444edde085f1bdb3389e440d0bcfa2a290a74567b031ca83fca60e9c7baa77d810ba1529b5f31453cbf6b5b343193

  • SSDEEP

    12288:Dpe2myy55555555555555555555555555555555555555555555555555555555h:Dpsy

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2