Extracted

• • Target
    2026-08-19_be73844f87f67cb4ee2fc2e930a62072_amadey_dharma_elex_smoke-loader_stop
  • Size 13.4MB
  • SHA256 64f3d76df719d7ddd60bd5288da945db1f9e5644197187e25bcaf6e668dd2a4b
  • MD5 be73844f87f67cb4ee2fc2e930a62072
  • SHA1 176a5b8cf6633e01749f9df27270d2acf4dafe6b
  • SHA512 b4a3fa317052a721ead890fc14636970a7024f83182b5b493c11b1822284fc9f60b9ab88daf898bfec5b1fd2a49f30d5593f002e8044fae044baba49318a0653
  • SSDEEP 196608:ekkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkQ:
  • TLSH
    T182E6A151A6F9991DF7F39A301CB433946A3BFCA7AB35927E00503A0A2C327D19D91763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2