Extracted

• • Target
    2026-11-02_679557a6832817f6aade9fa5a9cb10ce_amadey_elex_smoke-loader
  • Size 10.5MB
  • SHA256 e9ec7a74c57ce28cdddfc71904d42546291581dab22e6ebab2513a8cc6d7b30f
  • MD5 679557a6832817f6aade9fa5a9cb10ce
  • SHA1 aa69952d328729529ea84357e42841e28a27b658
  • SHA512 136bc9d9a62da988894fea0645a38d70d9250681349481b65d07e51b896ce18db43ce293994652d34f5b9d902d05a8ee61e88650ab79e5d96dc8f65c3dd36332
  • SSDEEP 3072:G0Zpq7y0UybpdmQdaIxTp1PnY7m9UTvDQXIQhUbPFb8jUJeYVU4FMOKvEkjuD2m:+UybqYaup1fY7bQJgFbfJHLCOe3ju
  • TLSH
    T180B67E7068349177E2BD067DB7143B6254FCEBA0E9A4907BD2E069D6052272F64EB30F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2