Extracted

• • Target
    2026-08-20_a5f69987ce4c36b7aeebb7b0a83c53af_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 10.2MB
  • SHA256 361013bee2dec40663ab16db27c46eeba99f0531db43a36c2f67b2da7977484d
  • MD5 a5f69987ce4c36b7aeebb7b0a83c53af
  • SHA1 f516e3128814fb3cecf9bd8a5f1ec9b19504aa56
  • SHA512 3a31b459ed2eeee13d2f25d7bab1441024ba4f8b4f3c1b7d4c38985322dbc25fbb8f6c49589ce2f6d09989b824d2c80d95e4decc813723b368973a4880f36c9b
  • SSDEEP 49152:a++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++2:
  • TLSH
    T187B65A3205F528B9C6F9483EBFAEBB54E79EF3828754813B644047F0547626E69F804B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2