Extracted

• • Target
    2026-11-09_2b009fd7efd1e865a8a7b581239647c3_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
  • Size 11.3MB
  • SHA256 e9da9bf62684773f1260700315702d57606b2d137b9a9cd7a8a892eeaf514af1
  • MD5 2b009fd7efd1e865a8a7b581239647c3
  • SHA1 f46d71badd471ea11f716dfacd27f9426a0eb72a
  • SHA512 54df1f10f281ae9cadf5a4c6fa18ffe9e5158ad400c67c1d3e782ea2f30d2985d72c61bbb2677492ee6fd7c680b61bc7e2cce075d469c20dde3a58db3410f6f0
  • SSDEEP 49152:YFjs1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l13:m
  • TLSH
    T109C61730BBFE554AFAF35B3095369AC85A7BBC43F931825E20501D1B1D72E909D62B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2