Extracted

• • Target

    2025-04-24_fa29ae15984e225b895704dc9b51327d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader

  • Size

    10.4MB

  • MD5

    fa29ae15984e225b895704dc9b51327d

  • SHA1

    55e813efe5b4b07f86da0ab058300395d583676e

  • SHA256

    ad0cc42187310b7f1064f9e4acdf765989bac422c5e14e24f9f082d1d3820198

  • SHA512

    ba9d820a5746982d8f0227d27562b3c3938f6a9cc15a7e09a46f826c18483c0d973427d39d9c2a8c85e7acf0eb3cb67842e4c4e2c5f2afc819352c8cd6c0f393

  • SSDEEP

    6144:1YA+NfOZ6nr80YzuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuP:1YA+tO6nr8X

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2