Extracted

• • Target
    2026-09-04_aea6fef0e676f707e7e413ac6b531715_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 12.3MB
  • SHA256 e605ec0602499e3d71d017501b09cd904e2b53d88407094d03a9f5fbfd504e4a
  • MD5 aea6fef0e676f707e7e413ac6b531715
  • SHA1 5dc48565981dd2a62d2e7a4c5fa5c72b71d07bc8
  • SHA512 995af1fe9ae70689ba6dc8068a5e4e37363749c8e9ee7142ecbfc84708817b56514be4313dae8529d702546a2fe22f13abb36df993cb597362e008e0d1bc75cc
  • SSDEEP 98304:hL4888888888888888888888888888888888888888888888888888888888888D:5
  • TLSH
    T1B5D66D40ABE8180BF6F756344A3B5FD1953BF852E22183AB0BC3BA0F3D713515A92756
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2