Extracted

• • Target
    2026-08-01_faed22db27318e16796f44e91d0bad60_amadey_elex_rhadamanthys_smoke-loader
  • Size 12.1MB
  • SHA256 f77aba4b239eefa074538f5a33f19c899c705a34a008ea6d7c49fd32928bb6b5
  • MD5 faed22db27318e16796f44e91d0bad60
  • SHA1 ccd80f436a02b55a1ac4d509dc4a29a29afe99ff
  • SHA512 b988254f70a8ec98dea6edcc33a4f8ccda778c04fec3cec2baa1a75916c08f8e8a42adb8e922191f1316f7b14937fc898d6fa4890b55e3be9cb7d44ef8e25388
  • SSDEEP 3072:eyuyvGO7G7KJioC4NHHBW1RBU/4b1epcdhTKxaix27WXQ25fgggggggggggggggQ:UeosHPAhEE9KxaT+
  • TLSH
    T15ED6E55523E3A918F3F79A346AB9BB452B3BFCC35B30408D090476D75E3AA265C51B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2