Extracted

• • Target
    2026-07-05_8580f70d654c027854efa2f5b498877a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 11.5MB
  • SHA256 4c136a5f09cddca052f6a136edf8fa4af8d26de335d5076c7579bf032509b532
  • MD5 8580f70d654c027854efa2f5b498877a
  • SHA1 82700e46132e82f4bcc7366763f16502d309a19d
  • SHA512 937fce4a2aa98e8fb9f40d8eac8171b32b8e800f2349c7c3f48290076c2247f62024ce7153d663ddbfc2de22e1af26343952a34fccf411228733e00dec70e8c3
  • SSDEEP 6144:R+DLnCQj29e/dCOhIctzibHYALvULoA14444444444444444444444444444444I:R+D7fj2816cteYLoA
  • TLSH
    T19FC62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2