Extracted

• • Target
    2026-09-04_31611934addd997ac6379a763d3b5258_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.0MB
  • SHA256 2dc1e93b79f35c3e2036214a12e5f527409a35192247d26c949fa258678bcbdf
  • MD5 31611934addd997ac6379a763d3b5258
  • SHA1 15401e98a6086a12f2418265eca96937f6490cb9
  • SHA512 90e3401da243b56096aeb1fac18f052d92e4542980ddab337665a592e3d8b6bf4f653254cc6dafd9f0ef5da3b4134cfdfa8c743e78a3ea2c2ff5e76c90c320fa
  • SSDEEP 24576:MKSx55555555555555555555555555555555555555555555555555555555555r:M
  • TLSH
    T113C63952AED0CD96F6E20934597597AC4B3AFCD19A636267F1103F0A2D77A802DF0372
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2