Extracted

• • Target
    2026-08-05_46fb9d4ebcc1a2b1ed6f1237eab343f8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 14.7MB
  • SHA256 571d4e9d38251faccf440c76239fab801ea4b1c3f16d0d08f9dbe5d6afbcb736
  • MD5 46fb9d4ebcc1a2b1ed6f1237eab343f8
  • SHA1 989d10e45c66d39ffc68202be3598c0abb32d012
  • SHA512 4c499d27dddc60720900c4212da9099b49667313b5a4c9697affb5872adcba7afd2b2cd59004550b6472634c5e391e1715b016b0e6dfaf195c1ff2a2fec87329
  • SSDEEP 49152:di2222222222222222222222222222222222222222222222222222222222222H:
  • TLSH
    T163F63A12C623CE2EE4B4933EFB9C77BE68DD8AF142C0154BA935B4E0EC2915D49D560B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2