Extracted

• • Target
    2026-11-02_9b534e8135bf1a53cad9f104cc5436fe_amadey_elex_smoke-loader
  • Size 14.6MB
  • SHA256 f3c135f97d72977c25388d945463600408020a4e6f7593c098074d0e6346c03d
  • MD5 9b534e8135bf1a53cad9f104cc5436fe
  • SHA1 caee665cb77988f199789833b4c67fcc202c9deb
  • SHA512 4172b022643747a9096b797ac69117acd15768cf78347cd8bf80c73b160d4f880fe5129f6095ce18186d0e8ce630abb20373b49fd0b6bae5e3682082f62205d7
  • SSDEEP 12288:Pmssg6wmSQ2C8G7osWqqbQZeCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCa:Pm9gldGWB
  • TLSH
    T182F67D2A8FEE4EB6D47D41BC1A583F9D40EEE7B5A68CC367C42408D844136E934E197B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2