Extracted

• • Target
    2026-11-03_ce326b52ac79f4ac8dedf285243da79c_amadey_elex_smoke-loader
  • Size 10.8MB
  • SHA256 274a779cb1ffc49df357344f6f994ddc3144de2cc63696400e47460bafbc1409
  • MD5 ce326b52ac79f4ac8dedf285243da79c
  • SHA1 34acb0d34226dee300d76f4361e5c6e204695012
  • SHA512 4eda838b039d8e159fccf8e651227df0deaa816061a7d881045027708404dced1fd486d080e8d5628bef5ab6670d65573f37140090bcece95ef992528fc59cef
  • SSDEEP 196608:0wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwI:
  • TLSH
    T1C8B68D3996308877C07440BD677D7BA9927DFBE26279C17E274611ED8522A928CF033B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2