Extracted

• • Target
    2026-11-02_e9e6a9f1b06c013acfe7c72bd11425e2_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.8MB
  • SHA256 f52497e7ed115801ff54d7b35a691d0222b4d587f2d6c6467726d3fdb339ea8f
  • MD5 e9e6a9f1b06c013acfe7c72bd11425e2
  • SHA1 0673ed8b8ea4fc6e54d9821cb5d19acb2b777216
  • SHA512 e4ebb3bd7a94415855f9d7f6c05526e6f2fd0ff0e5191215b70b5c9e85ee61c863f5e2e71864568457e5a70840de4a0a8ef587c55aafae9d8ae996ca11b06be2
  • SSDEEP 98304:EddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddD:
  • TLSH
    T1A1C66B74E69CDD88E4472E30849A8EE4E77CFD85A850561331A43B4E39B7F0C52E52AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2