Extracted

• • Target
    2026-04-23_8d0103816e95711bf5481e268f298da9_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop
  • Size 11.5MB
  • SHA256 06abe6e21f0d05e7f09b3409a578bb3be469bd48bfa2850b4c073122eae83ed5
  • MD5 8d0103816e95711bf5481e268f298da9
  • SHA1 d986204c7f19b96dde3f7ca3ad34cfb64af1287d
  • SHA512 986d044fbcaee11763dd0fcb6bffd447680470a522d4024eabd7a7ff4d7f02d23090fea848b6545e66416944ab916c1b036b2e7fd170088a817a2ec18ce89b69
  • SSDEEP 6144:eb/qTWJpjKTI1rFeB4jsVSfnLqS5ICk1hcGPsAza:+xJtKTIpEBc6fP
  • TLSH
    T154C6950442F60D47DE6AFE74766E0A1FCEEE6417605EA31D21A1F42DA972E21CD23732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2