Extracted

• • Target
    2026-08-16_4d61cb3e56d5a7da3001c7455c2c004f_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 14.6MB
  • SHA256 051a1e249fe003dd42f67695e22f1afe88f2c289628c819ef2edac259026a276
  • MD5 4d61cb3e56d5a7da3001c7455c2c004f
  • SHA1 062d516557a7e3ed0e58438ef94262293d4ab8a1
  • SHA512 45d9e84b38f59ddd64a18488e88e7afe33c20ef51a7562336816bc4b9c25155a37d4da3bce1499caf6dd5045e31c67cf8c78e09b5d9a102f8ed3b5fbf8892d9c
  • SSDEEP 6144:4LhlC8DmKmVJOu8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:4dlpDQ
  • TLSH
    T1A6F6299166F6EC42F3FB0E7079B66A442E33FD93BA74839E1550150A6E322E1DD61B03
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2