Extracted

• • Target
    2026-10-30_2e18e3db4c04a30f6f5678d76ee7349e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 10.8MB
  • SHA256 37c450b50166b6e9d0a7146ad0974aaee168ac1375e647ae91c00c565d085cf7
  • MD5 2e18e3db4c04a30f6f5678d76ee7349e
  • SHA1 6d0deeb86d53b5a2140c01f8779162e9e80af4ef
  • SHA512 6ab041da56f97e3ebf48a703a4f523245080465889ecfd075088298e2ca50e962e17b71b599572d1a622a3c633c8a3e1a4a7d676c3b968a5d19b83b601317a1d
  • SSDEEP 49152:K2bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbj:K
  • TLSH
    T10EB66D9853A155A6DFE213F63F7E0B872DABF8CA512E46FE1C2E1E412D413005D8277A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2