Extracted

• • Target

    2025-04-24_2401f2703491e5444be48bddb24f4a86_amadey_elex_karagany_mafia_rhadamanthys_smoke-loader_stealc

  • Size

    14.4MB

  • MD5

    2401f2703491e5444be48bddb24f4a86

  • SHA1

    6d6c8f63d797638b245d21e26f2e3433162ad459

  • SHA256

    4634f1ca079d411ca63afb7fe5b1e320e9929a6de1e482884c1f0072f71d51b3

  • SHA512

    b055c900e7b2bec75e0163f417b56160216a631f09bdd268f3cc6203d9e094c66bb820178648aad74f93dc94355b8bac44bcb52b0128d2ea45de696fe4a87865

  • SSDEEP

    6144:qrpR8A6n7KzdbpQNU+yyYqrUdE05deEOx:qrpjqm5lf+yyYVE0PW

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2