Extracted

• • Target
    2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader
  • Size 12.6MB
  • SHA256 972c88a27400bcd329cd4d37501e86533aa5e83bbf439a17ab5459a570c55c28
  • MD5 5052cbc39c635f0314d6ef18a5d70f21
  • SHA1 5cf78af5bdfdcbe24a60d1d29004ee5ea064f681
  • SHA512 0a08023f90a9289f3bdb28abae1cae965c9a8326edb3265b2090da240573e515c4c04a13b2ce795ce2009aa2c0efeea35aea8ef4b4a04359224ff53c35f950a2
  • SSDEEP 49152:cIm2s0vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvf:cIm2s
  • TLSH
    T182D68DB484F2CD97C5FA08BC6FAD7F5649ECA2F3D60496B38AD624E560321F094D610B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2