Extracted

• • Target

    2025-04-24_98be42fbef322d5f555c3a5ba31fe183_amadey_elex_karagany_rhadamanthys_smoke-loader

  • Size

    10.3MB

  • MD5

    98be42fbef322d5f555c3a5ba31fe183

  • SHA1

    279fc16da2d93e9f26c59b0c0c565532282ee72e

  • SHA256

    4781e4b723b87b9c52a10456e8d32203c3427391dfcda3294770a901e80cdc60

  • SHA512

    aef411f9a412c156805b7295e9b5b22df2b8d66cd2ed7d41ad19d4f0afd1c0092bc091725aecc38b592802f155ce7bb82ec0db61e19b34948e9eb7bb7a2ac56a

  • SSDEEP

    3072:LItj9qmR1YGra4etPzs+0aIC7yKzbaBwNrrFpxf8cd/J5obromE9QsPBm:LgJFYGrTwzsyKwhFpxfLFH9rPs

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2