Extracted

• • Target
    2026-07-29_82e2c766b37ff4f707b62021a966c060_elex_maze_rhadamanthys_stealc_stop
  • Size 12.5MB
  • SHA256 acd4116a475b70324eb3367b4660200e2f7282dc2cea84abbe2e74c6a908c8f4
  • MD5 82e2c766b37ff4f707b62021a966c060
  • SHA1 298b4f3fb4e173cf29eb53630e8261b6b85f45a2
  • SHA512 00a1c8a89b5f7d22c7bb1000dbedeaed3648d60904c87ff88b797c7cab85d47e129e4e2b20a7b3fea0d001d750a0cd52c2a67a6a9863d6f75319e6b20fb10537
  • SSDEEP 98304:5///////////////////////////////////////////////////////////////:
  • TLSH
    T18FD67541B6E1E805FAF789319935D1F8393BFC97E859829F31443F1F38726926982722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2