Extracted

• • Target
    2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop
  • Size 12.0MB
  • SHA256 7e69e15d19bc3f7dd469aacceb0d9cd548c70eee41fe3d6a8991be7f10a1218d
  • MD5 8fd4eb0dc70aee63f73ef49fbfbe55bf
  • SHA1 4a6d65c6119655986b1a23cc5b4d856afc298a72
  • SHA512 1a6ea95b49cc6ee932608fbdf6cbf6c7d8157f8f2d1d432a76738dab58c35ea7c3d6178088734ffa968a4cd12576f5fde84172d07b9b7125a7b70977cbb10668
  • SSDEEP 98304:SMffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff:
  • TLSH
    T114C6325383E13D49EA7A8BB2DF2F86EC760EF6508E59377931199E9B00B1076C563B10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2