Extracted

• • Target
    2026-09-04_8f4695a05d2bc0826944281d681a954f_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 14.5MB
  • SHA256 86db0f3aa4696b148f81b6432a101aa434406f76c7d13c190b0953ed8b71d567
  • MD5 8f4695a05d2bc0826944281d681a954f
  • SHA1 c557bce604edb878c6a2a29565151b773d2aa4e5
  • SHA512 7ff087132454376bc02c090cbe93724b8fc4e8282edeb30fe33f5dae05c8a66d96bdd4c166901fd0c3bd3031e7ee87fa14f34c9cd47ed690d55de102a94ba99a
  • SSDEEP 98304:SL4888888888888888888888888888888888888888888888888888888888888:K
  • TLSH
    T1C8E66D40ABE8180BF6F756344A3B5FD1953BF852E22183AB0BC3BA0F3D713515A92756
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2