Extracted

• • Target
    2026-11-10_a6b0bf7d9a0beb4ecb4bbfbeb51f26b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 11.0MB
  • SHA256 ed50be083f6a3ee65ea50857d3ac8e971e25e704d1a4fd733d40375f16371657
  • MD5 a6b0bf7d9a0beb4ecb4bbfbeb51f26b1
  • SHA1 e35dac3358514004c67f529a5af21508f17be6ad
  • SHA512 53db71a6d787f7a232963633b42e7bb2bbbb69227085d30a2443662ff11cfdddf25a29f193ec1c977319dd63c7577d658b140ed608092da05a17fc330e578939
  • SSDEEP 196608:0tttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt3:0tttttttttttttttttttttttttttttt3
  • TLSH
    T1C8C65C026AFE4789FAF3967019BD7A845A37FD827B70C2DF1194524F1D752808A623E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2