Extracted

• • Target
    2026-11-03_619d50312613cb30bfe6b32812878ccb_elex_rhadamanthys_sakula_smoke-loader_stealc_stop_tofsee
  • Size 12.8MB
  • SHA256 80e6e361c41f34d1dce4287fc84b6a952aab63f7d762f47b8049276af48e2226
  • MD5 619d50312613cb30bfe6b32812878ccb
  • SHA1 af841f95a4193bd453d0e1621cdd3033147cc53b
  • SHA512 4ba7624eb4748e6001490645c1eac3bdf06f308d681ce20b8b28ac66bf9ad3a7d4b16d1a8fb25cdd79239dc717fbf1cf1fc5185613326a4a32eef0821cddb877
  • SSDEEP 98304:dyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyD:
  • TLSH
    T1D6D67CF0AAE18288F7F75B741B32EA85567BBC53B820574B11442D2F29767E08C537B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2