Extracted

• • Target
    2026-07-29_88a33a2bdb598094a965f21f946f32e2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.0MB
  • SHA256 25e1d5acd17eaecbaf41aace80d329ca872b41dce1653ca3fca7f011d82f52b6
  • MD5 88a33a2bdb598094a965f21f946f32e2
  • SHA1 a5c7a2b90e79ddf16981b15ef40ea308b339dbb2
  • SHA512 c0ff238b25603488405b4c0dba6564f8d612c6754f18078e97373dc2169576f381b191f7d4d3ee0eb4620366fa7aa1995f8ae2b4e446ce68609b7893a07415a5
  • SSDEEP 98304:SMkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk:
  • TLSH
    T152C65B95A6F89206FBF34F382B752B9C1E37B8A3B475C74D1214190F8E62B908E50B57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2