Extracted

• • Target
    2026-06-26_a1be8d65e1ee9d7ae2e171766cfba636_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc
  • Size 11.0MB
  • SHA256 a9b0936429ecee59145d9eddb8524dbe2bf04549326ea4d91d51fd12e42eae18
  • MD5 a1be8d65e1ee9d7ae2e171766cfba636
  • SHA1 f52b9b5bd4ed08b264ec21f2da447904bc9603f2
  • SHA512 f7b6fb34dd306db7aebb0b33f550403d0a15d402ce1a6b92671772637db5b7dd8dccc9f62c344b3a90081e77db2aca3af2f9f2e6ea3caec124ef0054eddee5b9
  • SSDEEP 6144:+Izw8mFAdhAtKlQXRbeoVp59Sqer5+nDFoGCCCCCCCCCCCCCCCCCCCCCCCCCCCCC:JEidhAglQhyupLer5+nZo
  • TLSH
    T14AC6851541F80D57DA66BE34757F1B1FCCE9140A702EB7092094F1AEFAB9993C82A372
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2