Extracted

• • Target
    2026-05-11_37160bb8b00d55dfa224308e8d342b4a_elex_redline-stealer_rhadamanthys_stop
  • Size 14.9MB
  • SHA256 7ee2591312547f4c1922720dc57be1a5d97b8cbfb84bb1bb1ebda42495fcc5fe
  • MD5 37160bb8b00d55dfa224308e8d342b4a
  • SHA1 9d5e23beded43063f5518d65bf827f2627d20564
  • SHA512 88fa6b21d637154d39971d383c0da5b2d23df32f9f3b28b222bb399e0dbc3a016c54d5d0a6972b5a81a04bcd7f36c2bd28616261afdfc5ed25d86e6b3d4fa78b
  • SSDEEP 393216:RvoooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooH:R
  • TLSH
    T108F65BB1B980DA45E484263C482BDFEC99BDFC845C41074772A83B8BB9B735326A157F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2