Extracted

• • Target
    2026-04-15_90b2d5bfbbc14fccec32d71856bde388_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc
  • Size 11.1MB
  • SHA256 af6e3ed94f84ef0bff8baf71ad15bf9ac4b9e285227ffa8b98cc63d87846357c
  • MD5 90b2d5bfbbc14fccec32d71856bde388
  • SHA1 6e17c7ab6fa61b65313e149e60ec7dae64fbdbe3
  • SHA512 a385644742a7620917e6dc56e5381d0c4d966b8fbb2e8f9ceb52ffec66f01839717e8c05f80b75907ec3b60bbc24088915c7fd9796ea3cf308dd96971a9f0381
  • SSDEEP 6144:0Izw8mFAdhAtKlQXRbeoVp59Sqer5+nDFoGCCCCCCCCCCCCCCCCCCCCCCCCCCCCi:zEidhAglQhyupLer5+nZo
  • TLSH
    T1CEC6851541F80D57DA66BE34757F1B1FCCE9140A702EB7092094F1AEFAB9993C82A372
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2