Extracted

• • Target
    2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader
  • Size 12.2MB
  • SHA256 29fe6eea69f112bbb4aa9cfbd68b59bdc22ca6c647524ee47bdcfb67e24c5778
  • MD5 7a6f5bb520d817a77a238518e375a5da
  • SHA1 1bf7277d2dc9791a48786f425811ffc4083916f8
  • SHA512 7eb625089cf259d1aa71ddbacb1940afee26ea36a57b42b842ca9babf9fef4c8a3bf7803370cb22e507dbda99d4e142bca7ecd62d490bd5a1bcc8221e439ded4
  • SSDEEP 98304:F+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaX:
  • TLSH
    T1B7D66B25DA7316B3D06549BDA26C3FBDDBFE83B0D3105437504868F898233AB29E5687
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2