Extracted

• • Target
    2026-05-31_012fc4138f0888a8a4ee30d10d662f4a_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stealc_stop
  • Size 12.4MB
  • SHA256 10f09cdaf3026e0cfd8f9155e21b3d650e86d9510b35170d8fee26c89955c660
  • MD5 012fc4138f0888a8a4ee30d10d662f4a
  • SHA1 a0fb05890f8c553661910cf0e7ab657326d357a2
  • SHA512 847066e638d19a3649bf31d26c460179d336ff522eaf180a97fccfa2a5170d2815553e44449209a5345213ceb8f8e936c742b2b958413608e395c4187fcb2ae5
  • SSDEEP 49152:5j893RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR3:5jg
  • TLSH
    T121D62A53BDE9CDB5C8B202BD6E7EB71C04BEE2606A30CD2B8212DCD1D927A9125D451F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2