Extracted

• • Target
    2026-10-30_056272656abd7b7e4e75f51fe7df9377_amadey_elex_smoke-loader
  • Size 10.2MB
  • SHA256 f5f781fb6d8af0b8a19bd3bfc75b96e28cff015774d1f645b66e30902605fe19
  • MD5 056272656abd7b7e4e75f51fe7df9377
  • SHA1 a6ee7f9aeff211401d9e2899e4b7dbc19b8f2be5
  • SHA512 90eac0704f397b131621a2415542ecf60a2893c2efb061bc64d464e143e946d8f4d80f34e129a2c7633aeb7302a253693e989c4d42bb2c60173cc41d7d0ac06a
  • SSDEEP 24576:cYe+TPJYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYE:J
  • TLSH
    T169B66DF1C871497AC4A5413C2A2D3F08A9FDD3F09AE57E6F669008F61C2356AF9D142B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2