Extracted

• • Target
    2026-08-28_2b5845322ad97db5410b9c19ffdad468_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 14.8MB
  • SHA256 040b01af8bfe4d64f042007f92de56d551e5f9b844edbcabec65d0c8ce28655c
  • MD5 2b5845322ad97db5410b9c19ffdad468
  • SHA1 863a77682ee067e4f1d5a1a3a60864b8af256199
  • SHA512 b5396c6c6a70e2460f05ce43c4270bf78111b6c0034ce00e500415442cc2b2b95bffbe08ee89f50859e6fc7c03f28e82e681eddbcb517731930d27190a88f984
  • SSDEEP 6144:gQywMZvS1U1yDPdDbvwlZoDJfffffffffffffffffffffffffffffffffffffff/:gQywMg1U1gPWl
  • TLSH
    T1EBF62F4293E13D44E7664F32DE2EB6B86A0EFD91DE5BB3A911247F1F04B1371C162A12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2