Extracted

• • Target
    2026-10-30_0bbc06b6cfb35e581b10eb117d89685f_amadey_elex_smoke-loader
  • Size 13.2MB
  • SHA256 4a1498ee2503689a39bf6279eafcf7f747f0651a2140c36194dd917e598516ff
  • MD5 0bbc06b6cfb35e581b10eb117d89685f
  • SHA1 867a87d2cdad2217f439eaf395d4ca85decd5423
  • SHA512 7874a6d52109cd7e7ed59fa3a1ab93ac93cacd44c716c4ae7e304e8ad5416f7c3c381d4a5b00cef8e0fa8dd7c0bdd9beddcdcf325051310fea0e5ec31a22cf76
  • SSDEEP 24576:8Ye+TPJYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYU:p
  • TLSH
    T14DD66DF1C875497AC4A4413C2A2D3F08A9FDD3F09AE57E6F669008F61C2356AF9D142B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2