Extracted

• • Target
    2026-11-02_a2197892460d2432eaa03e4bf18ad3ae_amadey_elex_redline-stealer_rhadamanthys_stop
  • Size 14.1MB
  • SHA256 9c70047f2d571453656987e667e8b5d4f3b261012803f00c6b858f558b795e50
  • MD5 a2197892460d2432eaa03e4bf18ad3ae
  • SHA1 dc4de5c1ad079c889b60b5abebd4412d48a78d65
  • SHA512 42a21367c688af3e9fc7bcf544b9c06c88c70a1a6d790e085c0eba8affc53705dcc85f28778944fb5c6fb8752ef31c86dc993a37ecddbfd52f419c223a3c7f3c
  • SSDEEP 24576:Udor7brnsssssssssssssssssssssssssssssssssssssssssssssssssssssssf:FD
  • TLSH
    T1DCE66DB6D9A48836C0A9817C13ADBB2D0BEDF5B1D893DA33A145C8D60C1327539DBE17
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2