Extracted

• • Target
    2026-07-31_4aa71a5280a3364976285481a994e062_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 13.1MB
  • SHA256 10d10de2b3a9d9515547b398c875a936cff888c584cc41519bfe34307ac17bca
  • MD5 4aa71a5280a3364976285481a994e062
  • SHA1 93b97cd2f418da8fbe15c92f76cfad4bb24d8d68
  • SHA512 7fa9f70d78c6ab51356799f406ddedbed4783a5e85f94d68696f2acd69b6de9191daace144c66226605183c76347ef13651e14e99028a7be06232496c88280a5
  • SSDEEP 49152:JGEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEP:J
  • TLSH
    T1ADD6016176FE9119F3F79E346AB667981A7BBDA3783481BD0110230A5D32EC18D91F23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2