Extracted

• • Target
    2026-08-02_ac9d8f9ad1be4616864cadea3f5da201_elex_maze_rhadamanthys_stealc_stop
  • Size 12.0MB
  • SHA256 9a1695ed3ffb0c9ccecdc1b6561e48252b84e7c720a53e0e9400438bb219f7c0
  • MD5 ac9d8f9ad1be4616864cadea3f5da201
  • SHA1 e3307f6e3d7f2dbf1cc81aef2c95f2ef9a90d7f8
  • SHA512 0426fa9e849d5ee46e192e0d62ce923da8db8dfe5afddcb75137d205a5ef0b90ac0a1a76b643c1514a4a85af558a2d5f0515cb31a00b2339b870ea0c15a857f8
  • SSDEEP 98304:V//////////////////////////////////////////////////////////////n:
  • TLSH
    T1ECC67541B6E1E805FAF789319935D1F8393BFC97E859829F31443F1F38726926982722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2