Extracted

• • Target
    2026-10-01_745c125ee7bffcfa253c24413293ed7d_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.8MB
  • SHA256 b51372d8296dbe1c14d9e9ddae75b9457dfe30c52fd71587f756ed51553d3319
  • MD5 745c125ee7bffcfa253c24413293ed7d
  • SHA1 12d0b5f55c0a2b50a987d61a7e04e11265e47799
  • SHA512 eb9f06688f30aabc4605436528e5bb343e897b2099b0bfb52f4fee0844bba311c06a6444a3b13e44b2332486239d9df8e09a26680aa265fbfed62eb3192fc3d8
  • SSDEEP 6144:0B+Xj/mRJFhaDgVeAB7CZAzqaj3TJ4JfJ/J6J/JEJtJ/JEJ8J/JEJnJ/JEJRJ/JY:0o7mRvhY6eAvuaj
  • TLSH
    T1CFC674E715DC49DBE48A1B7C24B26A2BCD90FB74443A152225C4E9CF1E8EDDB065C3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionstealctofseepersistenceprivilege_escalationstealertrojan

  • Detects Stealc stealer Version 3

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2