Extracted

• • Target
    2026-07-10_5495394f2f98c20dc7ece87d212a1fe8_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
  • Size 12.3MB
  • SHA256 a9308548c380bfa4fb4643c26784620d204f0f8cf9fc2845b84b8785c272793a
  • MD5 5495394f2f98c20dc7ece87d212a1fe8
  • SHA1 5a66d2d2422bc269df9a09715c944daf61e9ddf6
  • SHA512 f27b72cee2a980a69514698e8d577709dc47189fb4645bbfc2308ea04f00869f9a6c229f03519ee9595f6ad5ca7e5343f263f7e1897e9738ca9b3a3fa42dca4a
  • SSDEEP 12288:7lraEMM7iLYQH8SwAWbE7Eer5+nmer5+n:7lraERiLYQHNYbE
  • TLSH
    T119D6960846A60947DE6AFE74766E091FCEEA6417B05EB31D21E1F039E572E21CD23732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2