Extracted

• • Target
    2026-07-08_320a79dee55cf23e3ba089795cb652ae_amadey_elex_njrat_remcos_rhadamanthys_smoke-loader_stealc
  • Size 12.0MB
  • SHA256 999dfd9dde7e9c8aa5c49a38c44e996f184140695642284af47d49133e4af245
  • MD5 320a79dee55cf23e3ba089795cb652ae
  • SHA1 1855ee52b70b2f3a9746bd0bcd7fc658b3587a12
  • SHA512 5a1e26337cfff859b33f18acbfa89fd1f40f107f5c5ba7ca3aba98094ab1fdb095444e940da52117cabd99ca11611a123b7719dd502df762d5c42d921d156f97
  • SSDEEP 6144:+Izw8mFAdhAtKlQXRbeoVp59Sqer5+nDFoGCCCCCCCCCCCCCCCCCCCCCCCCCCCCn:JEidhAglQhyupLer5+nZo
  • TLSH
    T193C6851541F80D57DA66BE34757F1B1FCCE9140A702EB7092094F1AEFAB9993C82A372
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2