Extracted

• • Target
    2026-04-25_343c6f2434c0bd81de66d009bd5b6a19_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
  • Size 12.8MB
  • SHA256 ed191aae07a19a462ff91210b007ec3bbbfdf7b4d9a63f5c2493c339d6e67ba0
  • MD5 343c6f2434c0bd81de66d009bd5b6a19
  • SHA1 14cf039ac5af93e85366b27b447b2c2f8f096a8c
  • SHA512 6bcb8dad377a1574c24b647164b261263856424cd63f5bc88e248c642d9c106639882128bb71f368b69358016723893e4a8b3db3ef57349499c7ce204be3e124
  • SSDEEP 3072:Op+d48tF8JfG1R2povLjuV6wsUx5zDIXU83h+tiS16gfN3VVEEMp3VJZhwbw3m:jtz3vOVh53I98tOgF3NMplJZw
  • TLSH
    T153D6542C14BCB80DDFADDD3081AD0EFFC2DE68D7BA54595F82D3C51C2A62A7616826D0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2