Extracted

• • Target
    2026-11-09_634424ce8a8bf7a66a26219a05e362ce_amadey_dharma_elex_rhadamanthys_smoke-loader_stop
  • Size 13.9MB
  • SHA256 ffdc0e03c42cb7e78ef28aa6b1c8bff6926b230cab84f7b78c48a5cd9c92c912
  • MD5 634424ce8a8bf7a66a26219a05e362ce
  • SHA1 08127e9c3d3a3a313b99d4dce774d84b36a1b8b4
  • SHA512 696a029220084179b4d92b7f02d252c20b2a48272915bfe2c6c6474da774fc99f4ec59ca9f904909918536c0e9c8e65b470d04945c519e3ba6c258a340eeb4c7
  • SSDEEP 24576:AysIaRiqtFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCFCk:ms
  • TLSH
    T149E6E84DF984D809D5E19D368970C5A81736FCDAF905CE87B0883F2BB8F219126A1F67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2