Extracted

• • Target
    2026-11-04_9e6372f8b19769a1ceb861c275763ef9_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 13.4MB
  • SHA256 b79cbeffb7ff25b07c888c2a2d5a3f49c19fd6868e477337fd1cddaadc7a66c2
  • MD5 9e6372f8b19769a1ceb861c275763ef9
  • SHA1 c98c55fd00dfd6bed09f3ff2580e8344246ed2fa
  • SHA512 9f70c62117f051f7898f58e206a90e763f5b4e33b58a0c62d3388ec4232cf466203f467b3d40447651580d265c487c5851e789e622c3358309d21ca4b8d12d98
  • SSDEEP 393216:Urvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:UL
  • TLSH
    T103E61851A3E45D1AFAF35A7048769AC41A3BFCA37B30823E12503ACE1D7E791AD41763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2