Extracted

• • Target

    2025-04-24_0cc0c102db8022d5c64701580d976809_amadey_elex_rhadamanthys_smoke-loader

  • Size

    12.7MB

  • MD5

    0cc0c102db8022d5c64701580d976809

  • SHA1

    96cbb275028d6ddd177148b06fd0652d692e5d8e

  • SHA256

    fb0a2f4c820b33f294e83c2d8e7cef0fc1aa43951cfed4b3af58eb2d33c2140e

  • SHA512

    f3c52b3fa54f6bdcbf9ec306306b563fb7e6742b6150bbe4adba2fba1e908a7fcf7cdf950667ab06abc6fcb1aceba55863cbcbeb986ea0936d3110971c4a2fd8

  • SSDEEP

    98304:kIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII+:f

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2