Extracted

• • Target
    2026-11-02_f07dc1c67583ee97f1a84cdaa53cdae6_amadey_elex_smoke-loader
  • Size 14.9MB
  • SHA256 c1e05ba3f5ade922470e0ee50caf137522121fd7821a9448395cddbdcae9548f
  • MD5 f07dc1c67583ee97f1a84cdaa53cdae6
  • SHA1 09f831a1f73bf912e4e6ee2e8bc1c71f634f45db
  • SHA512 4de6bd5bd23455657ddf0b0b2404108178405927ae74ee57fe6efc478d1f43f68ba7d7b5413c47d058a32297d4ca2e029e16c2389b5fbad1372329ff4c7d7815
  • SSDEEP 12288:EzmkTQbC/BzOM9PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:Ezx/
  • TLSH
    T19DF67D36961924F7C1BD517C727DBF0266FD65E2F23880A38A901DE2EC122529DBC52F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2