Extracted

• • Target
    2026-07-07_3715e1db1b236a3c24be5210bf9bc52e_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.9MB
  • SHA256 c871f5e7104b0cb18ae1ac0e0e3797712f286b969d3dfbab056886f325c46f04
  • MD5 3715e1db1b236a3c24be5210bf9bc52e
  • SHA1 67663da15eb02508067614f2c32710563a2a7eeb
  • SHA512 e4932fda0faf69d8737d7188c5fad6ea82039ce36eb8e86dfb9318eea61c2d668bf03d61abe453305ba572b3056db5d7e73ef89f0433c11d7040f241ecf3dfb6
  • SSDEEP 6144:HgaoUsajulQpfqtA1C1twSqer5+n/9Sqer5+nDFZxxxxxxxxxxxxxxxxxxxxxxx3:H6taj3k61Ccer5+n1er5+nZ
  • TLSH
    T122D6500541F90D57DE66BA34757F0B1FCCE9181A706EB30921A0F16EFAB5953C82A3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojanadwarespyware

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2