Extracted

• • Target
    2026-11-04_77f7ae6cce30c21626e9103459fd698f_amadey_elex_smoke-loader
  • Size 11.7MB
  • SHA256 409c792350e05351df2adffad66b027ea64121be3fe02832e07d67891f97f94d
  • MD5 77f7ae6cce30c21626e9103459fd698f
  • SHA1 95e19ac7078b5a544103bfdf578c3d1c2f5f5cfa
  • SHA512 729d729e6129059e836698bc53dac712089916c76e565b20d2f6030d50534bd1011f000f19649c017c52a029183444b667c728014dbefe68d5b997ee6a97091f
  • SSDEEP 6144:1YaOsVAqupkugc4XJcxGrSXuZet0yobAPrWDA+zFb88888888888888888888888:aan+qufqXJUWSXuZet0yobAYA+
  • TLSH
    T1EBC66B208126BD7FC5B84B7C667F7B4947FDE2E25A68993B872288F548761194CF030B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2