Extracted

• • Target
    2026-07-15_f0c63f13add30aa7c8fb0d6175911b18_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 10.6MB
  • SHA256 50202900b69cfe14133d9d6c4fc04e05f51200e1a56a81980d6be2ad09e0dbb2
  • MD5 f0c63f13add30aa7c8fb0d6175911b18
  • SHA1 7091dfde66cb1689a130cfdf17b21fdeee40df47
  • SHA512 c0caf6a19afb6fa959660a39a4861731660b83e2ac3aaacbcbb7bf9573feabe7432681480e47af399847ee0b8a96c4c5849a4a790c5bb2d45d6be09f77743d47
  • SSDEEP 6144:rgaoUsajulQpfqtA1C1twSqer5+n/9Sqer5+nDFZxxxxxxxxxxxxxxxxxxxxxxxX:r6taj3k61Ccer5+n1er5+nZ
  • TLSH
    T180B6500541F90D57DE66BA34757F0B1FCCE9181A706EB30921A0F16EFAB5953C82A3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2