Extracted

• • Target
    2026-08-04_206e2b42c34700c0cbc55ee296c3f225_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.1MB
  • SHA256 5544c41365338a7ea444f841706d45802cfbc7c4372b2ebdabbad411bebfd26e
  • MD5 206e2b42c34700c0cbc55ee296c3f225
  • SHA1 5667c2aa83c6d1ca54bb1637555cda12f30163d9
  • SHA512 f27b1d9010316e7cc5895601e7abc9c95401bbce10bff538a5ae0e3c9e3779d8a85dfdbfc88b6f2847d1339c983754f178c3fdb0acaa1deca902858d6fae7f66
  • SSDEEP 98304:sszzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzX:
  • TLSH
    T1B2C63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2