Extracted

• • Target
    2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop
  • Size 14.7MB
  • SHA256 e5d446d32b31436195100a96d1af8d75bb20c600d2f103805919ef34818d6fbd
  • MD5 7ca8a96e8619553f62b833ee593ef250
  • SHA1 f4f57c7ae9098edd3aaf5401b4388cc6bb9361b1
  • SHA512 4e99b14b77b11d3268330e67fd209af1409b53ea001dcd9a948473e27493e5380f6c0bc3ba14878e128bec66b3f85e374bb33940b403f3d6b991be780ea2d412
  • SSDEEP 196608:qzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:
  • TLSH
    T1BCF6F7E1DEA07BCDE7220E709A1ACBE467DDB950DA246A1B120CED0F297C761C51F721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2