Extracted

• • Target
    2026-11-03_348b34ea99b0ca0d900df45a34da0dcc_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.1MB
  • SHA256 a15e6a2ebb8c7cac6f5e9ab47e11542530a227b33df99ee2f2b0b6baa26438e0
  • MD5 348b34ea99b0ca0d900df45a34da0dcc
  • SHA1 b4afec99514cb7a48adaa5203d7db09f4a5d81a9
  • SHA512 f8b8e88f2c2df7306d7753010ebf61463dca4662aed568c181c9def76b700aa1c6a98a0b0ab2bf779ded62498a9dfadc04716192f623baffb990a7dab9ec22fb
  • SSDEEP 196608:FEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEk:
  • TLSH
    T136D63910BAF5BA59FAF34E3C59717B8D563BBC42AA35811E104C311F1DBE6830992B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2