Extracted

• • Target
    2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader
  • Size 13.9MB
  • SHA256 020399b0c0807440c1bd0d8278635f9d608e93d23054f387c5b79ae938ab1dbb
  • MD5 5544fe73e02d0281f79c51a9bf9190a5
  • SHA1 d9dbb68e9eb7666ae541c5cfdc44894210b50e48
  • SHA512 07d9489f75c7dcddac8328fdab1ae49a44bb6764b2be92d9050e74aef1a3e71b53832f0a4f33b651e45dbc927246a076c135987061c90810a14e57490842b055
  • SSDEEP 6144:KHqwnbbymwxbMBaw5PH8tNLpO7yXlLVD86g:cqwnbbHwvwf8tNLphXl5D
  • TLSH
    T163E68C300568B4A0C06551FE3B2E7786E7ECD8B1C71E9ABFA18964D0DC22BB742D475B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2