Extracted

• • Target
    2026-08-05_2618c943b52ad373c63395daad70dc15_elex_maze_rhadamanthys_smoke-loader_stop
  • Size 12.4MB
  • SHA256 eca6deea7a3b142c6d695d1d48de3ebb39c5563d5341cf47cb68a9d749dd12eb
  • MD5 2618c943b52ad373c63395daad70dc15
  • SHA1 22188d2f649e19f6563999270b614a1b30d0ecc8
  • SHA512 4f0a22abbfcc2b5b6466cdbbc32ed86cbbbeb2ff2009bb12773883d33c9871a02eefa9d0962c5bcf8ddc0c7d129ea51d8805f9668436c7d44fe7c2d3f649d31a
  • SSDEEP 98304:OMfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffn:
  • TLSH
    T1E7D6325383E13D49EA7A8BB2DF2F86EC760EF6508E59377931199E9B00B1076C563B10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2