Extracted

• • Target
    2026-11-05_6682f85908279d500abec6a86e66b1f1_amadey_elex_remcos_smoke-loader
  • Size 14.1MB
  • SHA256 30e7231fb97fd10f45278897ba9a1a49a937727792e78e1900fc340602aa5c87
  • MD5 6682f85908279d500abec6a86e66b1f1
  • SHA1 d527e0a8955903a03f9b4db36ddf6a2b8c2ed08e
  • SHA512 52274cc5b16fb42efc9f71e8fcd79c2fc357c0e7366f92bbfb7dec2eacea75ed438780a3acb60fab5c4e8ce77e2a546e179f0fc5764ce06e1010458cf0c847cc
  • SSDEEP 24576:LMmDJxagM666666666666666666666666666666666666666666666666666666n:Ln
  • TLSH
    T1C1E68E320CA844B3C0B4857C75A93775EEED56B2F38D46BF29A016F9A4332B999F1503
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2