Extracted

• • Target
    2026-06-27_b44c3fca99651dbc7d0887d946579726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
  • Size 13.3MB
  • SHA256 66155e1b19ae396c0119299e797c44bda4786bacb9a0f8c440179600c7edb760
  • MD5 b44c3fca99651dbc7d0887d946579726
  • SHA1 5fd794dbb353df562539207423a55c2626532bee
  • SHA512 e97f688bf63663f906b0e950007debd219c37eb0d4f5facef65e5a260a4a998ad3b635d38d777d58e4a8ad14dcf9f4a6149ff2c0c127b74456561cf2d6523dc0
  • SSDEEP 98304:YIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIP:
  • TLSH
    T187E68E8046D1C0ABCB5543F42B3B06876FE5BDBA67A583BE351F4C866EC13851C276E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2