Extracted

• • Target

    2025-04-24_bd52a3b3c1e689704790e5d36724f529_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

  • Size

    14.3MB

  • MD5

    bd52a3b3c1e689704790e5d36724f529

  • SHA1

    55de08b9f0d72fbabaf4a17f13a0403eee1ab0ca

  • SHA256

    fdebc3f5ea422c3a9b5607cec105547693cf6ef7fe6e3e802d38451995564391

  • SHA512

    9b1764433e6ab26b83b83e01ad44958410b1432da606df9083ddc0dbfd113dacb1a5f6aed29fffd3cbf4709730b87a96f872f9b966b42b6eacc397238fe4a197

  • SSDEEP

    12288:epe2myy55555555555555555555555555555555555555555555555555555555A:epsyh

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2