Extracted

• • Target
    2026-08-05_b214c40307fa1c3157639861a360c063_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.0MB
  • SHA256 cba320fe9df99ed1a8a2739583aeba041dca216bdc180545ae1339a059262e0f
  • MD5 b214c40307fa1c3157639861a360c063
  • SHA1 cd4109052b4b08f67bf712792bbc5196bed57912
  • SHA512 b9b89e7cea8f1f02fecb31be70ec674bdb1001454be302415c0e4f50662c5b015ffb0979196122041a69f7a01f5661a45fd6d25e16308459c08deacefe118053
  • SSDEEP 49152:5++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++6:
  • TLSH
    T19ED64A3205F524B9C6E9483EBFADBB14E7DEF3828754853B644047F0647626E69F808B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2