Extracted

• • Target
    2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader
  • Size 12.6MB
  • SHA256 9e28ad096644f303885a42fa9393ef0666dc2d36935cb85c4fee62eb9fcb2e7b
  • MD5 f9297f57e7432c4de89cb791e9083c34
  • SHA1 9a8bd43e3b90bd71c0632688f10db388b531ea5a
  • SHA512 50f54d97bbbde93db7fc907a4f6202b7b33635354018de25252802c5b9d08e43c1c95a82eb527cd614d0b08f654bc2a6ff79a14241534cd460a2fd6e0c6bd718
  • SSDEEP 24576:8Swf8lsd83RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRB:Pwk
  • TLSH
    T1E3D68C211AB84D2CC4F549FD732D3F1189FEC770EBD1A6A7A90828F548B75BA24D2427
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2