Extracted

• • Target

    2025-04-24_77ae8172e25513d04f9f0cf3b48eaa47_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

  • Size

    12.4MB

  • MD5

    77ae8172e25513d04f9f0cf3b48eaa47

  • SHA1

    65a8406869a963af3a55817f86d2e3f95de0e8da

  • SHA256

    439bfd662173bd3c9ca858fe401e0c0c9930f32e2f672ddd5b3fe9e6a6318ceb

  • SHA512

    3788bfa126862d38f3f4eeae8d357f722d61deb0e239899a6c665aa4f1c3e8b048c63a548c8cd4f986ec5011afaa16f17c29d7510dcd59228ddf7acc280c3dfa

  • SSDEEP

    6144:5YA+NfOZ6nr80Yzuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuy:5YA+tO6nr8XO

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2