Extracted

• • Target
    2026-07-02_a76ef331e8f9136783d281c3884b3f8a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 10.4MB
  • SHA256 7c587ad63305a2ee7c6449fc35b01fda6dc45ad84ee379b55baa7ce71473dc7b
  • MD5 a76ef331e8f9136783d281c3884b3f8a
  • SHA1 009619d99d28acc20fe7448637bced142b9149f3
  • SHA512 2a99defcc1b1c5c8cead78065a645ac7c14b655e377c11e7db176a65a66982767a08738d6fa60dc8e9f0b3cdedf2e1c688b8e5535a2151e347eea9c3d7bd07fd
  • SSDEEP 6144:H+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444r:H+D7fj2816cteYLoA
  • TLSH
    T194B62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojanadwareransomwarespyware

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2