Extracted

• • Target
    2026-09-29_fd28025154e52ac480ac5e5884fc3ce1_amadey_elex_rhadamanthys_smoke-loader_stealc
  • Size 10.5MB
  • SHA256 a58893b19c2ed76aa613d16eb67e693b3828024a38c37f01652f2f8fde9fa17d
  • MD5 fd28025154e52ac480ac5e5884fc3ce1
  • SHA1 9d8619544a6972fdd3664fd14394a0338fc7e53c
  • SHA512 0fc70c572bcc4f3352001294e7faec8254ffcfb6090ae2ad4cce7082cf14e6d58f3cae6f3041a6d0164db6cd80536e5a71104e60e3fcd10c07d6e817e5fbcfae
  • SSDEEP 3072:rurXX+PBiSWHn9SBwcA/Z80HN1TFEGP8HOfwjQ6bdFor3Yz+HKa13jjjjjjjjjjz:IXVSOn9SBKh/TFEGBfw9vo7FHKa
  • TLSH
    T1BAB6EA617BF2A045F7FBCA3666314958AB37FC6BF96AC31F20448A5B1C21681CD46B13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2