Extracted

• • Target
    2026-11-02_d5981d3807739f2b248587d258fde89b_amadey_elex_smoke-loader
  • Size 11.3MB
  • SHA256 3ae03f0d93e29a77c0530de59e85d9b804d31f3380830c375b1198259ceb76d0
  • MD5 d5981d3807739f2b248587d258fde89b
  • SHA1 c4a0577b2925edcf48f85c382cc488d67479afb9
  • SHA512 4472963d9a2b26857ad48042fdb651240b0cea31843328eeb1b9c65950de7ca9a33be5bc18eeb2c6d5c8603e8a45ef001a5d433adcaf9904bf4e3424170834f2
  • SSDEEP 49152:biWkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk8:u
  • TLSH
    T177C67C35B36588FAC0BD53BD3A2CFF5169ADFA71E34497BE80940CC88913562C9B542B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2