Extracted

• • Target
    2026-09-04_14593089bb9a5be9f068014d5d4e42f2_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 12.7MB
  • SHA256 7f26e53c0675b031516fc16c25a316effeadc92589784679aa04aae0b741f3a3
  • MD5 14593089bb9a5be9f068014d5d4e42f2
  • SHA1 2aab847351410a24ac91680ec0f472e068615767
  • SHA512 1de0ce15216f9ed23e1cc207106ae5271b400a6e28da91a5813191bfc7141512fe897efd81d3c83535d6d7bb458ab9e8eb098a37f919c945f7a1adea320ae844
  • SSDEEP 24576:wKSx55555555555555555555555555555555555555555555555555555555555z:w
  • TLSH
    T16FD63952AED0CD96F6E20934597597AC4B3AFCD19A636267F1103F0A2D77A802DF0372
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2