Extracted

• • Target
    2026-08-16_14bd652ee4b0e07d6759c723ee19f1ce_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 13.6MB
  • SHA256 8377428905b0e0147233414b52b3b784c3aa8a20fa572fa7f51025605e524c90
  • MD5 14bd652ee4b0e07d6759c723ee19f1ce
  • SHA1 cfe91b2e41ac3e6449d8bd194ad62aec78a7afbf
  • SHA512 f578f8495c28676a9dd5f23eec54c90879a042ba392ef7b23ffe9c17dd1976d018ce797bb3b32597bd30c8e7b6cffa168bd8481c22aa62c149fd0269c3069f4d
  • SSDEEP 24576:8sI92c2e3333333333333333333333333333333333333333333333333333333H:yQ
  • TLSH
    T128E6018386E53F46EA668B728E2FC1F8761EB553BE4DBBE911189E1B1070372C153712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2