Extracted

• • Target

    2025-04-24_911cc72595c886bd04b38f3f743109f9_amadey_elex_rhadamanthys_smoke-loader_stealc

  • Size

    12.0MB

  • MD5

    911cc72595c886bd04b38f3f743109f9

  • SHA1

    3bb6bc81ee5aadfbdfbff577d4f0f2d850a4040b

  • SHA256

    7490667402a3864b52bf399e609af8b640f42a82ee678789d405d06bd86640eb

  • SHA512

    8a0adfad5e97848c24b40ec354954c1c66dbd99b9ba60340067c08f07116771027d227758b24d831176187830beeee5746590015a79f6ad86f2e1991cbb74a9d

  • SSDEEP

    6144:cS8dp/oVs7UHb+KCmkxdUtCEUiiqpL3ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZh:bgAVwUHbNKdZPqN

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2