Extracted

• • Target
    2026-11-07_7f7b19721ee0f5dfcaa6648406ac0f2d_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 12.4MB
  • SHA256 5be3415b662a0bca56089b93e58491c7cd209463909964ae400c354d1308d605
  • MD5 7f7b19721ee0f5dfcaa6648406ac0f2d
  • SHA1 0fc2c4b26973d24f3191d1f46793bee884594204
  • SHA512 7a2c7640cbe2021f9514b7ac7eac2f7fbde90420c996751a8d9022a32ca88007218541193de7448d82549b7beca684700dd26b62cd8f380b1eb599935c1b5070
  • SSDEEP 98304:C3bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb3:C
  • TLSH
    T14FD66BF5AA9DDD84E4472630841ACEE4237DEC55B854520331A43F8E3DB7E4C92E62AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2