Extracted

• • Target
    2026-11-07_2f42c582872b3630944d32282fcfe501_amadey_elex_remcos_smoke-loader
  • Size 11.5MB
  • SHA256 b966c3a448b7b53ad819577f72f39aef7209f0ce8307a72122efcebb00cc9bab
  • MD5 2f42c582872b3630944d32282fcfe501
  • SHA1 9d2f5e716bc7b95f1f9b53a56a629329d31f8260
  • SHA512 4d9d665b13769a113a717262a4b86751a662a4d64cc7caad64fa0687eb1df7985fe381f8ca7c13f623ced330051bd14c62df79d414b532845ebad8abbaab382a
  • SSDEEP 24576:qMmDJxagM666666666666666666666666666666666666666666666666666666n:qn
  • TLSH
    T1B1C69E320CA444B3C0B5857C75A93775EEED56B2F38D86BF29A016F9A4332B998F1503
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2