Extracted

• • Target

    2025-04-24_5316c7f17391a8a95080067242009981_elex_rhadamanthys_smoke-loader

  • Size

    13.5MB

  • MD5

    5316c7f17391a8a95080067242009981

  • SHA1

    90a20d4d6c044ea0e8c0a94e34e24a190f4f1e83

  • SHA256

    8005a91e28fc8af0f39838dfcacb9b436874c36812aaadf9db498046a364e4fe

  • SHA512

    6ef4bcfffd5af3d70ef9a276209b34ce615f2b00ef1039fe2279ef110ddfa0d3c39427d4b195b5b71643798e24e7b61db075a4b8e07addeb7f616b4a1cbbea2f

  • SSDEEP

    49152:4qL7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7I7IH:4

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2