Extracted

• • Target
    2026-06-28_2c021f17ea3074685a65b4653524f206_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 10.0MB
  • SHA256 878e01b44da611c6b93a275e64d93f589193aea594d46dcbca86aca783ebc3b8
  • MD5 2c021f17ea3074685a65b4653524f206
  • SHA1 184753e6fa1a1c6ebf1748732f43c88ab7246811
  • SHA512 52cf77a48dc97e48b79c7fe89ede527f6257e53b0144aff063da261f499301246104275401b374ebb40e52582c261b1caa92fdfb2608c4cbdb27045efc635238
  • SSDEEP 6144:p+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444I:p+D7fj2816cteYLoA
  • TLSH
    T1ACB62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2