Extracted

• • Target
    2026-08-06_0ba935b6d66ba1ef337b57d1b78b32f6_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.4MB
  • SHA256 91b198a6ad93c18266b72f34dab176b864eadb3dc7fd32d40b60e92fabd562c3
  • MD5 0ba935b6d66ba1ef337b57d1b78b32f6
  • SHA1 0e777b48eb490993861a1013b7a769c3cff50f50
  • SHA512 7f34b05f745fcc190b3cd15ee8fa772cbcebccc0830e20cca7cb1b2d4ecd0edc317941ab10248d0c012157bdf995862fce05f9f215c592977da34068e8b583ed
  • SSDEEP 49152:v++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++z:
  • TLSH
    T182D64A3205F524B9C6E9483EBFADBB14E7DEF3828754853B644047F0647626E69F808B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2