Extracted

• • Target
    2026-10-16_e31970be6be966cfa0f7212904119e79_amadey_elex_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee
  • Size 14.9MB
  • SHA256 74715116c63c25e21110d7547b646142cdf0a624a4fa6c9a86c250ef53edebbf
  • MD5 e31970be6be966cfa0f7212904119e79
  • SHA1 c2c963ac133f27f4285dfc1cd7d181e59f1e7236
  • SHA512 a256f1bb026a5c68a2eb426499d623299dade48a92926e2ef5c7e9c111697b189b2dc36d550c0e94b94576d71f2ec91ecf36d4e79955c9a9b5028476d139e836
  • SSDEEP 12288:5lraEMM7iLYQH8SwAWbE7Eer5+nmer5+n:5lraERiLYQHNYbE
  • TLSH
    T183F6960846A60947DE6AFE74766E091FCEEA6417B05EB31D21E1F039E572E21CD23732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2