Extracted

• • Target
    2026-11-01_b280e92d29e7c8974e182538add3feb5_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 14.9MB
  • SHA256 7fb5ade0f5814c8f03cadecbf0e38ec7f1c915114ef681f808f6ce69282138b7
  • MD5 b280e92d29e7c8974e182538add3feb5
  • SHA1 a5104672ec95c9990afa884661f7e7c38ab1168c
  • SHA512 06f8867458bc1fa8dfe394e800fd7403de8ea1888e5d2cc70f2046674b1553f2e9540ffbd7b4b6ff8d33d4b63ab06eebdb7f528185f83e61b1ee92ff881ede17
  • SSDEEP 393216:qdvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvn:qd
  • TLSH
    T123F61851A3E45D1AFAF35A7048769AC41A3BFCA37B30823E12503ACE1D7E791AD41763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2