Extracted

• • Target
    2026-11-03_db07edeb4b1c4cf246842edc18f831e8_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.5MB
  • SHA256 06b852bf9fecf30abcd8da639a0f8cb5d54ca7793c43c29725e4d55677b9df6d
  • MD5 db07edeb4b1c4cf246842edc18f831e8
  • SHA1 d3fcca92a70c67a348350504d95c58d6dab76dbd
  • SHA512 8ea6bfb92918dffdc7db8d3706625efa74765fba841039c09662c48381b5b946dcfb7db88bc8b85b973e3269206f036dd087c4e70974ba09eeaaeb360b20e97e
  • SSDEEP 196608:fmvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvH:fmvvvvvvvvvvvvvvvvvvvvvvvvvvvvvH
  • TLSH
    T1DDC62851A3E45D1AFAF35A7048769AC41A3BFCA37B30823E12503ACE1D7E791AD41763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2