Extracted

• • Target
    2026-11-05_8721748cd917b87e82c6d8d4c51e0a7b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 12.1MB
  • SHA256 b18dfa0ff3264383ebacb61dbcf7659e23d41c06216922f30ce6be1107d11886
  • MD5 8721748cd917b87e82c6d8d4c51e0a7b
  • SHA1 f0052fddf9a0d0720ec6aa13ab3f9e3a0e94d15a
  • SHA512 045fd70fff15cb1f223cc6a187b7cb817cab63801db13ad7dd3b257e6e211a0ca3cfedd899300282fb5d80238df03366327af3be22170f703cbc4f2c4c049ee7
  • SSDEEP 12288:uefMf1mvOKCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC6:ue24v
  • TLSH
    T113D64B0166F5BD4FF9FB5AB01D36BE882D3BBC83B62152CE1140222B1D765509EA3793
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2