Extracted

• • Target
    2026-11-05_427219859bc7187654abc5ef7ad39df7_amadey_elex_smoke-loader
  • Size 12.5MB
  • SHA256 e388784d4ef062c479052fdf84cf13900f15f0f8b6d8ab6e23e6513b39f4b0ca
  • MD5 427219859bc7187654abc5ef7ad39df7
  • SHA1 b5848a884bada9466b98a41cf3d45a23c555fb11
  • SHA512 530257e7dae2fafcfc204aede7773d38380bafec671f319ad066c7ab33db6d22646c489d89d50db3fb7ff4f15450df8a821bf684053dd31b66f9e4e071bdaf39
  • SSDEEP 12288:0mssg6wmSQ2C8G7osWqqbQZeCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC3:0m9gldGWB
  • TLSH
    T148D67D2A8FEE4AB6D07D41BC1A583F9D40FEE7B5A68CC767C42408D844136E934E197B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2