Extracted

• • Target
    2026-09-04_5313866607404b580e12efce57778507_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 14.1MB
  • SHA256 87dce95c77fd66d59c9716a660acb07fb4c957056453563ff93c89306503f9ba
  • MD5 5313866607404b580e12efce57778507
  • SHA1 b806cf5a6b7d987a5d70ada0cffe107e8476733c
  • SHA512 f4ba876d8dfd887421b66cf8abad5cf3ebd9f43bfa917a4154622720f5a42dd1be5b69307e233f0cf3e268ed7a403e7e5fbef2c1982f351c897690eafc6dd82c
  • SSDEEP 98304:EL4888888888888888888888888888888888888888888888888888888888888E:A
  • TLSH
    T18CE66D40ABE8180BF6F756344A3B5FD1953BF852E22183AB0BC3BA0F3D713515A92756
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2