Extracted

• • Target
    2026-07-31_e6a3c9c124b6a3635c8c291b91bd279b_amadey_dharma_elex_smoke-loader_stop
  • Size 12.9MB
  • SHA256 88fdbaa9421186007467725da3d2476d9faadc2eefb794ce1559c37d89dc92cf
  • MD5 e6a3c9c124b6a3635c8c291b91bd279b
  • SHA1 9608177fca495e120c927462a60a9fe7a51e8d8f
  • SHA512 8a12b58dd68418f191728d9dfd121ccdc9f9ab3be4b19b4bf10a1fc4600e5e097aec29195310fee9502e1f014f62496807b819b753b0fe9a432cab5aa2b8196a
  • SSDEEP 196608:+kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkc:
  • TLSH
    T16DD6A251A6F9991DF7F39A301CB433946A3BFCA7AB35927E00503A0A2C327D19D91763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2