Extracted

• • Target
    2026-11-02_c774fc8e69274df78724c970d6e9b6f6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 11.1MB
  • SHA256 fd74c22bc8393a7d51feed137f440dc2a71422e031e9567386eb378819bfcc49
  • MD5 c774fc8e69274df78724c970d6e9b6f6
  • SHA1 ab46ff80f67a6ad3bd73369735bbe8bb485a2dbb
  • SHA512 56424402a68f0a4e9d9e9c24b8d28372c7093bac8f7cb8fdad87f0d4902334bcd53aa3c5d1aa9e4151ceae0f1e55a070e19a2216d875ccea4015c44c227e0f98
  • SSDEEP 24576:0X044+000000000000000000000000000000000000000000000000000000000U:0
  • TLSH
    T172C64BC16AE65D4AFAFA5B311975BBD54A3BBC427934C34ED150321F187EAA00E813E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2