Extracted

• • Target

    2025-04-24_c2628445ecf95fc4b216d3c66a28b665_amadey_elex_karagany_rhadamanthys_smoke-loader

  • Size

    13.8MB

  • MD5

    c2628445ecf95fc4b216d3c66a28b665

  • SHA1

    8fd94140be2e1ae77db451b45eb063b9fbda4936

  • SHA256

    684981f04c9516d694dd549d6156ee7d2a69f14568fa0f899cc665c5e9d20232

  • SHA512

    cec531df1829297156a0f2db623753e8eca0e6183e7f5b2889c0f847e60f48c43a19b61ebc5b9a628c8ad0698550cd597ae05b111e25860dc644b254283e267b

  • SSDEEP

    6144:s8CHoLztEhfDI8KGNcFwH4wXIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII:s8CHoLOhf0DGNc

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2