Extracted

• • Target
    2026-08-05_641dea53a31f2047f2c2486e739d1b6c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.7MB
  • SHA256 c2ecd9cae136c73b87d886768728e8243221d097b91cacd4404dbc2f5d9318c6
  • MD5 641dea53a31f2047f2c2486e739d1b6c
  • SHA1 f3a44fbcccecfa93c674ef5f73a51c49ef0cff98
  • SHA512 4e28cefeff2d4492cdf3ee9ccfc98ea572557c2b0895457bd18fad96bb85a99b20b66bbde44b6b7800a110832ec547cf0c81fd1272d9cdebd61e00cfbc29b425
  • SSDEEP 98304:5szzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzX:
  • TLSH
    T1C3C63B5037F35882F7668E7A66369AB4D7FBFC92F821929F13419B5F1870781C602722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2