Extracted

• • Target
    2026-09-30_73924e095cac183d3b49af705a75d17e_amadey_elex_karagany_rhadamanthys_smoke-loader
  • Size 241KB
  • SHA256 51ee40a24d5a051557faafa1b2dd8f1fd6ee28f38d4a502193e900bd8aa7668c
  • MD5 73924e095cac183d3b49af705a75d17e
  • SHA1 4152daa991d4e44da4fde8df5aa0e5b713585c3a
  • SHA512 bccf969741127f5174ab9e1813f7f92446851be8907e5eeaaf2eaa3e88af6c43426d962482aec3d0e73a84661ffaf59b7a9c68ca2d35959b7a72ab3175e412b3
  • SSDEEP 6144:Qe7EQenCWHHnuuUNlRltZBCzJEp7XHyrmt:Qe7EQedHnuuI5Tb
  • TLSH
    T192349E107BE0C035F4B712BB5975D3B5A52DBDB1AB25C1CB62C52AEA9A346E0EC30743
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2