Extracted

• • Target
    2026-11-05_33dbe71c60a9d29e08c766f8ab2f4076_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 13.0MB
  • SHA256 11a3333db82999c4fe4dfd03f2507c89c74b90ea222d8f620e873a92ca3fd3dc
  • MD5 33dbe71c60a9d29e08c766f8ab2f4076
  • SHA1 514ac0bdd03ad96ca15bdb19b77baaca728ebddd
  • SHA512 674bfca8a1226d5ec9065f9bfd3d10bd7876984d3765b1991245b5907f51a7cf8334783e1dda3a0e48f4e2017aa97d794cff8bc1dd5a0c3088c6648999e38ec9
  • SSDEEP 49152:zDUG+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++O:k
  • TLSH
    T186D6268DBAE15549FFF75A301C3297850F77BD23A921824F2044325BEDB26A4B9B1363
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2