Extracted

• • Target
    2026-10-31_8389420d985ef215be99561c42e53125_amadey_elex_smoke-loader
  • Size 11.6MB
  • SHA256 97ece86616a3229f188533ba7709e8c9e428876f9834f755f61d85e429fdcb1a
  • MD5 8389420d985ef215be99561c42e53125
  • SHA1 50b92e9006e0ada3752df62bbbdc88e08b0a2601
  • SHA512 7eda3ca9b3a0156f96db5285247c4b2b2dc5adca8b5dcbaafd439c4bd690a4016aa7f530b65c5dd0a92ee8075b493149e4e6cb3a7c48fe81df14136c739ac9f8
  • SSDEEP 6144:+gNII8gWeaWhxQ4GX8GWwA8dotD6qykoNw:+SCZQPGX8Gjnd46qyP
  • TLSH
    T17FC67D3605F198B2C1B8417CF37C7B444AAE9AB0925CDB6B425216F8ED13BF809F8657
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2