Extracted

• • Target
    2026-08-17_275f60054da5e230653f8a70339d1ed5_amadey_elex_rhadamanthys_smoke-loader_stealc
  • Size 12.1MB
  • SHA256 804cad4b8864de9ec57e822b7fc0e38e8c5832f603c2b2e41ba5b60acee6b50a
  • MD5 275f60054da5e230653f8a70339d1ed5
  • SHA1 bc588e1f73622074acc77311ed16f595aae646f6
  • SHA512 c53272ce395674a576f1f57f82b938956b1741fce71827faf5f601ab08b341cd525b62ac9a478363b26359fc9706287386e9973a25d56cb0c1cc4e3b8d053016
  • SSDEEP 3072:4urXX+PBiSWHn9SBwcA/Z80HN1TFEGP8HOfwjQ6bdFor3Yz+HKa13jjjjjjjjjj7:RXVSOn9SBKh/TFEGBfw9vo7FHKa
  • TLSH
    T118D6EA617BF2A045F7FBCA3666314958AB37FC6BF96AC31F20448A5B1C21681CD46B13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2