Extracted

• • Target
    2026-07-12_5e4b02a0ea021046fc680485ddfe5707_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
  • Size 10.2MB
  • SHA256 abfc3be189c63d5c7ab2178ffb896ed9758a0bec87424a130048fac36ebc1e29
  • MD5 5e4b02a0ea021046fc680485ddfe5707
  • SHA1 570233ca6095c17c57cc6176a84e1458154ae216
  • SHA512 3d767cec9b1540a73e6ed684db3298d5a5f92487bde8d2689bb0b53fa2f361610ba782c1b71bacfe7ca23047ed235f64f0984aeb584ce6c83185ae9bdd6334c0
  • SSDEEP 12288:ClraEMM7iLYQH8SwAWbE7Eer5+nmer5+n:ClraERiLYQHNYbE
  • TLSH
    T168B6970846A60947DE6AFE74766E091FCEEA6417B05EB31D21E1F039E572E21CD23732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2