Extracted

• • Target
    2026-08-12_9e9bb48fb800ff67165fc1e9d3a6de79_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 10.8MB
  • SHA256 1578e45cf3551ab51868c4acf29e32092afb39abc4fc8af741c93d043ec8de73
  • MD5 9e9bb48fb800ff67165fc1e9d3a6de79
  • SHA1 e651a70bf258b08699fd49416685ab7dbd7090f4
  • SHA512 aef1cacdc7936d2c44a864024f76dbbeb5238de98caef3ae18fda1023bbfe05e38150ff43b1a5ff66ebb7656537939d19e39f5fa459082202465413bfa427dd5
  • SSDEEP 49152:Qp0855555555555555555555555555555555555555555555555555555555555P:p
  • TLSH
    T184B6C5816EF59911F3F38A34497557A81A3FBCA7B830815D238036CE6CF66915EA07E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2