Extracted

• • Target
    2026-08-03_bc5eee6268bfeac593e3af6cdcf21e62_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 14.8MB
  • SHA256 a8686101432755f96e3290caf8f8c6b18a1d2f2d9b7d5e2e434f6e2aa75b44aa
  • MD5 bc5eee6268bfeac593e3af6cdcf21e62
  • SHA1 b97045a201e8f7399f177c3e02aa1f75791f0f24
  • SHA512 4f2dc137729432a552f5c94a1ea1929dc3ae8ef47af2abbb5418e415b054973ba9c7e81a6d6df55b8273ad90992ad148ede476e1f384451704ac27c044072fe1
  • SSDEEP 24576:3GAAjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjT:3GA
  • TLSH
    T1D7F6E67161B3B809DEE947319A35E6F8652AFCA18F75929E30073A3F24331AC85D3719
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2