Extracted

• • Target
    2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader
  • Size 15.0MB
  • SHA256 4a563a6d75de3775a3c51e949da78c6e5d0afcd9cdf871d08a70ee519a816d06
  • MD5 b941a80d828332ba4689cf856222128d
  • SHA1 740d6239179adea02484a105c6027f86b83d7486
  • SHA512 5d2f83deecb991e0634d0382feb164164ddc0f50abd53a1d9190b4ea10bcbaeb02e27a4b1fce5bbe4aac31423411bf781cf70a33764e71fe6c8266d747a52388
  • SSDEEP 24576:yMmDJxagM666666666666666666666666666666666666666666666666666666a:yn
  • TLSH
    T18DF68E320CA844B3C0B4857C75AD3765EEED56B2F38D46BF29A016F9A4332B999F1503
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2