Extracted

• • Target
    2026-07-31_3591f58bf8cf29c9a9bad4a53114fb54_amadey_elex_remcos_smoke-loader
  • Size 11.0MB
  • SHA256 0fda81e7115c62f0c9399b73c6c5e80aebc2135cc460da602878dc859de60139
  • MD5 3591f58bf8cf29c9a9bad4a53114fb54
  • SHA1 a1cd93274b44b7db8578fd7cca78d77ff2aa46bd
  • SHA512 316732aea577c3f18e94678eb1f0ce53c70f3d2d36c99d2f30d8f5a6f3d04b5acbb2f93d05630de2fb455e1ca10a3c77fa5be6fdc2dbb87a41d7e215381dcd69
  • SSDEEP 49152:DawwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwY:D
  • TLSH
    T1C3C65C70D4B38A3EC474067CBB193B155ABFE7B0DB8925F6939008F3586B915386628F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2