Extracted

• • Target
    2026-06-28_1cb1f0288da9fd398d2c93439396e952_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 11.2MB
  • SHA256 a759302a29246ee14cc7ccb84c9a0e620a49ca8f51c1b3e52982cf03e91031ad
  • MD5 1cb1f0288da9fd398d2c93439396e952
  • SHA1 f60f7d2d72ff0071d467ac873e9e3af4d545ab2c
  • SHA512 4c39ac4ba57781766baef31a51270885321e3c95f26be2464e2c9e843dcce2555cafe0f4d82b436fa7af10111e039b2f7254de0a127a419ee334c02da5fc8fbe
  • SSDEEP 3072:rImLmfxjq5wVTz+FLMFwERLfT/TI5EegVS+gVS+gVS+gVS+gVS+gVS+gVS+gVS+Y:zLmfxvVTaJBELfzT
  • TLSH
    T1B5C6830176988859E1A66D365534A6A21736FCCBFB25D7C735883F1FAC322D02A70F93
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojanadwareransomwarespyware

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2