Extracted

• • Target
    2026-10-30_e5ecf854d01769acdcd1d8527490059e_amadey_elex_redline-stealer_remcos_rhadamanthys_stealc_stop
  • Size 11.4MB
  • SHA256 9cc44d6d242634f3778982062b548577db4d86efc1a0d9585787adb17937fa5e
  • MD5 e5ecf854d01769acdcd1d8527490059e
  • SHA1 b3f67cd9477b95432e74f0e21610871272b02292
  • SHA512 69feafa775ad5b77345cf2e8fe60f685ebe6105cc5538d016aabd460968bd0d53d47958f07d7dacfe97c9a059a949c4ca074698c62598d7cdcf95d1cc1a826e4
  • SSDEEP 49152:9BXhSq1PDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDT:9BXMq
  • TLSH
    T160C65C31D6E719AAC8FC817CA33D7B310AFEF2F19D197527C21491E918132A519EB84B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2