Extracted

• • Target
    2026-07-31_8e2e5574925ecab9c266bf3f201b7be0_amadey_dharma_elex_smoke-loader_stop
  • Size 11.0MB
  • SHA256 49347549055661e702f4abb748a5f9ffacc719e2a13c22378248ece23aaaf3ed
  • MD5 8e2e5574925ecab9c266bf3f201b7be0
  • SHA1 e185222e5c5438227ef0a8ab1df38495c6250c71
  • SHA512 c2ae4f3fe87dd4993e3d013147b304076455b57083e8608a5206f853662aba0967b2c18ca15acbc6e07b5669bb1bae94d4663deb42bd145a1419dc5c55cbd6cc
  • SSDEEP 196608:3kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkI:
  • TLSH
    T1BFC6A251A6F9991DF7F39A301CB433946A3BFCA7A735927E00503A0A2C327D19DA1763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2