Extracted

• • Target
    2026-09-04_729f6fb31a6a8479ecadd3329f5f27d8_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.4MB
  • SHA256 a8a07c253cbd1ba296aedeac2b823949ce7b561b264231401cac69e3f218eca8
  • MD5 729f6fb31a6a8479ecadd3329f5f27d8
  • SHA1 44fa7c4d9067d7c206fbcdc130327a1a45ca5f8c
  • SHA512 aaea7163d3145348b217605392ea8369382b7db2bb8d74e8ed2aa53cebac6e5755427539deae9f9e44cee0c833607b66be5cd0ece6b5aa8acb1de8a26383ca34
  • SSDEEP 49152:sGEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEc:s
  • TLSH
    T1E3D6016176FE9119F3F79E346AB667981A7BBDA3783481BD0110230A5D32EC18D91F23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2