Extracted

• • Target

    2025-04-24_ddc86d1a437c23af56309f60aa60a924_elex_rhadamanthys_smoke-loader_stealc

  • Size

    11.6MB

  • MD5

    ddc86d1a437c23af56309f60aa60a924

  • SHA1

    eb1e96ac18a78a3e900d70a396d8f501738c9da7

  • SHA256

    83f5743c625c73b1fd32fc508c287d5217111eaf466008cef608b924b3405404

  • SHA512

    8967f03a36d4ca1f90d85ade5cf8c7b6ebcfeb7c381501541668ab0df039f960e75500a605945b6118f1371f8535c31282205a0438c24b7676aadf9d333175de

  • SSDEEP

    12288:ympoQgA0IRTL9KJyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy:pyIRTL9

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2