Extracted

• • Target
    2026-10-30_9b8062dc6cf4383fe6c1c96e0fe4d196_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 11.8MB
  • SHA256 2f21f8eadefd646b5f32e3f14061c4c7073c8da9d5e527f0effc9c18a3a101f4
  • MD5 9b8062dc6cf4383fe6c1c96e0fe4d196
  • SHA1 af235de1dc6463a09462df898a4f97be05c82ac5
  • SHA512 4e412cb845fd3c47f127db667fc0d4633dfadd9b5af17d8f3cd23e28a947afa4be753f01fe1b0b287b7dca1eeeed0a6e24cc89ad419bbf4f6afdfe64f7032e11
  • SSDEEP 24576:3COUruvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:3TUr
  • TLSH
    T1F4C67B01BBE55D89F6A56E305862BBD01337FD56A9F0A60AE750E7CF1CB33508962323
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2