Extracted

• • Target
    2026-08-30_dddb837921641aad03c2224836e401d3_amadey_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 14.7MB
  • SHA256 cb9dd034f4eb15f91007e7c09e9b5bc78b46d52b0d6b83ef893cb05c16249231
  • MD5 dddb837921641aad03c2224836e401d3
  • SHA1 0f081386cde168ae21c3ea1a1cb7f03e14effd66
  • SHA512 7a13f8f2e7fda6338b8a7242f7e893308d2129e4b57457837c86ba156056333234d7a8239739923e66b360326f9e952f48f454a4ff79c71d09f2c790250140d8
  • SSDEEP 3072:W7aTKGL5SMvNESAL+pfDhzLV7z3MBnYP1WVzLrRGZNv+C1o1o1o1o1o1o1o1o1og:pTJcSAL+p7hJz3GYdOgjv+
  • TLSH
    T1C9F6694392AD3F44E9E54B7E9E3FB6EC760DFA508E49BB690138AA1F10B1177C153A10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2