Extracted

• • Target
    2026-08-18_bbed71f5213e3bbd6de72dd1510377a8_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
  • Size 11.0MB
  • SHA256 8f9e7fa186c75d89118abbc3f583f6d314949bd5254d0bb94330787de94b4243
  • MD5 bbed71f5213e3bbd6de72dd1510377a8
  • SHA1 4b18f3508ecff537a58826ccd6a956646e12fc9e
  • SHA512 3867371f3a3bcde93e06bd33fc9092fd35b8d0e3716e0a0795497e3d08b50b0dffa84d61d066219488f1a5b8ed23a93fde207481a877819ad84cc46bd19363fa
  • SSDEEP 12288:HlraEMM7iLYQH8SwAWbE7Eer5+nmer5+n:HlraERiLYQHNYbE
  • TLSH
    T170C6970846A60947DE6AFE74766E091FCEEA6417B05EB31D21E1F039E572E21CD23732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2