Extracted

• • Target
    2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader
  • Size 10.3MB
  • SHA256 6ef63158e5bd1d1c10729f312a724516ec1b743f6af62b70ccfe4222b5b812ed
  • MD5 34374987977df6f217154242b1566a50
  • SHA1 13679d23f92be09d9e0835e32828143f96b5df5a
  • SHA512 8be25db1daa42221de9119b3d36e56a81df1677c0d8eff7532a5c1a5c2cd30841e939ea2e5ea1ba8ad59e239ce2393d5eabbf4a0b0674804dc1b9083f61a4db9
  • SSDEEP 49152:yawwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwX:y
  • TLSH
    T1BCB65C70D4B38A3EC470067CBB193B155ABFE7B0DB8925F6939008F3586B955386628F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2