Extracted

• • Target
    2026-07-10_d5fac8193dc3e55d7d5c091a23b77b7d_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 243KB
  • SHA256 cd029017259c426333887e718cf3405a74a2187058ee3238f342be04247bf940
  • MD5 d5fac8193dc3e55d7d5c091a23b77b7d
  • SHA1 509bd09c9eb23bd03474430903d912042bfca82c
  • SHA512 82f817e3c398e9f1cbf3b0820ff73d7e400fd96d0c35360e45d5dd49bf5baac242e98c3b4ee0fd8fd3088765bbd432eaaa0b78ba19a740c256259b252d77a0e9
  • SSDEEP 3072:tVMOx0sRYfI17YOfd0Q2lcLR/TmW2ZMqU56CCPvkquIW97AVt7clQHU5utV8Sw:sOUfI3uQ2m1f2hUuXc19E+QHuoL
  • TLSH
    T17334BF2275E9C133E6E319344EF9E3B16A77BCA28B72808F2B94073E5E255D1CA14313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2