Extracted

• • Target
    2026-08-25_7cf5d9f334220d44285a964ce4e0ca9d_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 10.3MB
  • SHA256 6acf6dbd3f782249db5912e28772bacb2ef155a1e06b3ceddf9f4abfb8124428
  • MD5 7cf5d9f334220d44285a964ce4e0ca9d
  • SHA1 dadbd05e0be9abf869cab3157ba7192b4317fe85
  • SHA512 5e7882afa559e41c12664ae36fcd7933c059557f3259f8c342077912335e0bdfe35b10490715628b40fb5cf16ab6b0cb256f51f8588e66b9d9528783e4e96a05
  • SSDEEP 6144:ugaoUsajulQpfqtA1C1twSqer5+n/9Sqer5+nDFZxxxxxxxxxxxxxxxxxxxxxxxJ:u6taj3k61Ccer5+n1er5+nZ
  • TLSH
    T182B6500541F90D57DE66BA34757F0B1FCCE9181A706EB30921A0F16EFAB5953C82A3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2