Extracted

• • Target
    2026-08-18_206e0fbf0ff2529ae678f6d723dca5f9_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.0MB
  • SHA256 f8bb602cd4f981b2cf69988480592f9cfef1b822873aaa40e9602ea9c12b8427
  • MD5 206e0fbf0ff2529ae678f6d723dca5f9
  • SHA1 384ef4134231ef85c2347fe841eccd90dea5d130
  • SHA512 97e8281f5e5416913e225b705d8b6694742c76c1094709365a22b037987ec6d8da1215769d2c0a3307ebb26396b4bcebb4faf1e92cebdbad12bf262fc45952fd
  • SSDEEP 6144:qgaoUsajulQpfqtA1C1twSqer5+n/9Sqer5+nDFZxxxxxxxxxxxxxxxxxxxxxxxZ:q6taj3k61Ccer5+n1er5+nZ
  • TLSH
    T18FC6500541F90D57DE66BA34757F0B1FCCE9181A706EB30921A0F16EFAB5953C82A3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2