Extracted

• • Target
    2026-07-29_e5e7ee3e6a9358caf0c5d7558fb254f4_amadey_dharma_elex_rhadamanthys_smoke-loader_stop
  • Size 12.8MB
  • SHA256 42aee9f5261b20f6b071a97fe84076b4d7518176ddce273aa484c1297e82a968
  • MD5 e5e7ee3e6a9358caf0c5d7558fb254f4
  • SHA1 2ebfb9faecad9783f7b4fd7648199c15983ce51c
  • SHA512 11266cc0eceeb06d09e5ce8d90af5946a138615ddd5400d0c2f3d499220a9a7e8d6b257aaa87ac3a3fc50ee6db5398d37ee0f876ff0ac77efb81ace3d6b9a62f
  • SSDEEP 49152:nsyVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV1:ns
  • TLSH
    T1A3D6FD91BAF9D515F3F79A346A70A3D81A77FCA7B834818E6050370B2C726C19DA1723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2