Extracted

• • Target
    2026-11-03_ab3155305c7409aa76b27dd128dc2e88_amadey_elex_smoke-loader
  • Size 11.4MB
  • SHA256 14caca01dc2c43d85f313399900b0439f66b3083c94f5f0cd980b8ed7508709e
  • MD5 ab3155305c7409aa76b27dd128dc2e88
  • SHA1 411e2ecccd91916033f49934a8e325ab6ca5a8aa
  • SHA512 4d5dcd5aceda7cf37fddf26943b5bd3173e973ee702ea45b6c94c283f13e702d7bfe95721b3fca0f26bba47ace1cd1b9b1505b3b8eed27f79fff3ecfa4927078
  • SSDEEP 49152:9iWkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkI:U
  • TLSH
    T130C67C35B36588FAC0BD53BD3A2CFF5169ADFA71E34497BE80940CC88913562C9B542B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2