Extracted

• • Target
    2026-07-31_4faaced19fef635c0282917a4548eee4_amadey_dharma_elex_smoke-loader_stop
  • Size 14.6MB
  • SHA256 0ad745c9c85613544767e1336a324fc552bb1c46e20841da2301f7ba070ba388
  • MD5 4faaced19fef635c0282917a4548eee4
  • SHA1 88d9332844f149ff4facf162ec9f60b6c1554c91
  • SHA512 e92c92262c388a70e0ae0e2dd4094f160b072aab2e5dd9f3d5d0cb4b140181689d99ed271a4aa4f495959e945bc45c48520cb6331cbb82052f5033f5977fd300
  • SSDEEP 196608:BkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkI:
  • TLSH
    T165F6A151A6F9991DF7F39A301CB433946A3BFCA7AB35927E00503A0A2C327D19D91763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2