Extracted

• • Target
    2026-07-31_552c4aea360420422098f0575d67ef66_amadey_elex_smoke-loader
  • Size 11.4MB
  • SHA256 b6ffff6b324f2f6639555d8fbf65fa3807c312461757d11a0aaedeb6559e7b5b
  • MD5 552c4aea360420422098f0575d67ef66
  • SHA1 48cbe7c056c1a071fdd4c351b4b66cd25e684ce9
  • SHA512 4e1eb983b642cf58efbad584f439288a4623fa6f1202064612371bbebadc0365c54a7fd32a0dbb382be6574b5b23e76f18b581faba5a8a33b5f60522164cd8e8
  • SSDEEP 196608:/uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuW:
  • TLSH
    T143C6F6E1EEF5A902F2F6493C8935922A0A37BC5368B1D24F0458F64A1DF36819F50F67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2