Extracted

• • Target
    2026-06-26_09f9a860902d0cc0f0c747c2ab7190bd_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 11.3MB
  • SHA256 4223f1cd63681e0c8de770cf09076a41e38926e1310d2012a1bd3017a85d5426
  • MD5 09f9a860902d0cc0f0c747c2ab7190bd
  • SHA1 5f0829f6b08fda1487dc452f9822250ae93eda78
  • SHA512 5a576998a151911810954f5f93178f4e76eda4fbe9ce52864f95a7593733e404814beb796d1191edb3c75539fc443b672ae720a20cc662a832b4778a3883e771
  • SSDEEP 6144:WbdQ8FZLCSoNNs+P3KybQaSqer5+nDrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrn:P8FgfNeY3KaBer5+n
  • TLSH
    T194C61D0642F50D53DE69FE74766E091FCCEA285A706EB70C2191F02EFAB1D61C826772
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojanadwarespyware

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2