Extracted

• • Target
    2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader
  • Size 11.7MB
  • SHA256 694ceb78aab7e554bc34d4f6a3635bac7c161ca61097de89a0be2919a0c6008b
  • MD5 94afe7a87deaa2a56f0405a78aa5ce39
  • SHA1 b864b781e5a8368e9b883e588540681a7ce91232
  • SHA512 653580018425eb23dece120dba4e25e3a90f86fd2b885e71c7010947a7943adfaa2aec3dbb70c21d852cd7ec979fc463a610799cee9ab740cd71ee092fa5bf15
  • SSDEEP 98304:q+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaf:
  • TLSH
    T12BC66B25DA7316B3D06549BDA26C3FBDDBFE83B0D3105437504868F898233AB29E5687
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2