Extracted

• • Target
    2026-11-07_972df3485ec37492ce3a639feadd3b2e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 14.6MB
  • SHA256 42425477a7e6dae84fda8ce88ec6059e09a3d906de08482490b782379a79fb15
  • MD5 972df3485ec37492ce3a639feadd3b2e
  • SHA1 bbf9cbe5d6a379ac3783db8bfb82cf23c5d3d58d
  • SHA512 a86218d72e0f9027fe2ffb248c48d53d1ceb37f7da4776cb62034c434b934c367cde31e7d3456e7506a6e72611ea84d52ff7a7cbd7b465e1cb48c625f8be9ba5
  • SSDEEP 24576:bX044+000000000000000000000000000000000000000000000000000000000b:b
  • TLSH
    T16FE64BC16AE65D4AFAFA5B311975BBD54A3BBC427934C34ED150321F187EAA00E813E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2