Extracted

• • Target
    2026-11-03_640ca708b8aaba077102660a82600b75_amadey_elex_smoke-loader
  • Size 14.7MB
  • SHA256 59b3a336262f511544625edd78d8d974c92c2e00840eb2dc099bcc2240e87553
  • MD5 640ca708b8aaba077102660a82600b75
  • SHA1 9f0fc7cdf955b8e6f9942d22c7b5d870f86948f3
  • SHA512 67a9631467a89fe89fccf6885332303d4e9058057ef2ff127d9af3656409b69ced2bb772b476d058edcb33d0e4f2f6a1bf673bbfff81c4a90afa7f2ffa576bf4
  • SSDEEP 49152:hiWkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkko:g
  • TLSH
    T1A0F67C35B36588FAC0BD53BD372CFF5169ADEA71E344977E80940CC88913562C9B982B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2