Extracted

• • Target
    2026-07-06_fa3c4dd50d95f35e2afa9b96b77d932e_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc
  • Size 13.3MB
  • SHA256 24fa70078b960c39f5e30f139af86095c65fcaac03c8dad0d626fe88af8fafea
  • MD5 fa3c4dd50d95f35e2afa9b96b77d932e
  • SHA1 ce75ba06abadd8065688118f44e7eb33786fa5ed
  • SHA512 dfaf7f830beb148d586b4034db8ab109c8dab069d97d00ca890fcafbce8ba8a7da9692e5808b67851da8fe647f6c306a889ba2f592351621e31b959bd0f88978
  • SSDEEP 6144:3Izw8mFAdhAtKlQXRbeoVp59Sqer5+nDFoGCCCCCCCCCCCCCCCCCCCCCCCCCCCCH:YEidhAglQhyupLer5+nZo
  • TLSH
    T1B1E6851541F80D57DA66BE34757F1B1FCCE9140A702EB7092094F1AEFAB9993C82A372
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojanadwarespyware

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2