Extracted

• • Target
    2026-10-08_f075f546dd45b6b8f342f86afefcf38d_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 14.7MB
  • SHA256 f223ee30bfdef9614319f989bcdfaf5f6bf7b276e16c0d383f4eff0c691766e6
  • MD5 f075f546dd45b6b8f342f86afefcf38d
  • SHA1 a3477100cdcdd71c5ae509ff8a628875425b801e
  • SHA512 5c7da02c99d5cfd23206ef33f272a8f8919aba168d08681c4c1f9de6e1b70c4eac6bc8c2c8117bfd3565a0dffafe2d0a76f233850a5bceeaa77d3041a4aa4477
  • SSDEEP 6144:mHjBpYqdviTbDwkFyXapKagxexexexexexexexexexexexexexexexexexexexea:23Yqd6B5wO
  • TLSH
    T10FF6447392E13C44F6768E319E2F86E8361EFD919F1567EB12087A0B14711ADC1E2B1E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2