Extracted

• • Target
    2026-10-30_88cf5ec360e8870ef089daf8499de56f_amadey_elex_smoke-loader
  • Size 11.6MB
  • SHA256 8849eae960ea92a1fb22318ce633b2457ca81ef2d8689e8b43d46ac8bf2477b0
  • MD5 88cf5ec360e8870ef089daf8499de56f
  • SHA1 12c57bf7157f302fd8b9501067c202959da316ce
  • SHA512 407d7af234ce589c580d749636c7d88c5ea7727501d13e91397b74ace26414480eaf86c7f72e474ac37d48b2df06725d9a7f0deaf7d25e1af45c25b35a3eab59
  • SSDEEP 24576:kminVhqEJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJf:2n
  • TLSH
    T16AC67C61D772C837D4B982FC621E7B69C5CD82B7A64229DB19443EE40633BA35CF8217
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2