Extracted

• • Target
    2026-08-03_e025818ea0cd34709208457b461a5062_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.2MB
  • SHA256 74a718fcd5dcb2ba14fb580b38b685b59c7053a55abe1f54c9815f55bdbebc96
  • MD5 e025818ea0cd34709208457b461a5062
  • SHA1 9d471076761e1a175714751fd834e16fc7604bdd
  • SHA512 0cb97a523dc937e6eae06a80082f9b7cd64698dc54d3d5f2a6fd38ed929f34a9081a20a314d78aa88506bc5c62e48ca4ff7ddb3fa853ecf13eb55a5304e10aad
  • SSDEEP 24576:mGAAjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:mGA
  • TLSH
    T140D6E67161B3B809DEE947319A35E6F8652AFCA18F75929E30073A3F24331AC85D3719
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2