Extracted

• • Target
    2026-08-12_48dbb2115afbe87aec9cfb5c8bffb260_elex_maze_rhadamanthys_smoke-loader_stop
  • Size 14.4MB
  • SHA256 ea0762420656a5b247219602c9d70aa5418b8d7ddb6e824ddf8967a7e982b6ff
  • MD5 48dbb2115afbe87aec9cfb5c8bffb260
  • SHA1 d873a99dbb18b00d9aa9a3651180c93905d498bc
  • SHA512 8ad92d250f32832e0f60a047781e5f6262f80f72f1df68f5a62880394dc9adb1190633ac99ed7f02ca7f828190dc876d907957735f3a525dad7535f3eee21a5d
  • SSDEEP 98304:3Mfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffn:
  • TLSH
    T1B5E6225383E13D49EA7A8BB2DF2F86EC760EF6508E59377931199E9B00B1076C563B10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2