Extracted

• • Target
    2026-09-04_3f948861af094b065967fdcbebc3da07_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 10.8MB
  • SHA256 789ab1d5d5f105ed96d16e8802a3b8b7fee7d40ebddace48a6871c4a4a05fe98
  • MD5 3f948861af094b065967fdcbebc3da07
  • SHA1 62a9744b463563297c816ea3805bcd71cdf5649d
  • SHA512 9daee62d25e44b269f782d493e11668b8d20c082856a4caee62a78d9a72ba78d27cb5300cdadead553edb9221d49a8f670fef45e76186f34f7c774bb72c81d77
  • SSDEEP 98304:ZL4888888888888888888888888888888888888888888888888888888888888T:R
  • TLSH
    T1D2B66D40ABE8180BF6F756344A3B5FD1953BF852E22183AB0BC3BA0F3D713515A92756
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2