Extracted

• • Target
    2026-10-05_f7c978fe98cb5c839760ea1198b1a185_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.5MB
  • SHA256 afd1e72b7987276dfc4a97d8e85a195ab20b9720b3e610cc64847669475b2e70
  • MD5 f7c978fe98cb5c839760ea1198b1a185
  • SHA1 c48cb6054e1c9700962e8cb591f1094391cbfbb0
  • SHA512 c4e19881ee0b23e8cab62bd46e0590a3f841e8a502f04aee757c9fa547bb941ca90362cc93dfa4eb51fba6763819dce65207a4498f96940e7f55bc9211999281
  • SSDEEP 6144:6HjBpYqdviTbDwkFyXapKagxexexexexexexexexexexexexexexexexexexexeK:i3Yqd6B5we
  • TLSH
    T1DDC6447392E13C44F6768E319E2F86E8361EFD919F1567EB12087A0B14711ADC1E2B1E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2