Extracted

• • Target
    2026-11-09_1fd464bb9e06772654bf0f306392beec_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 11.9MB
  • SHA256 71b495c70c7d616ab72c66a111fe0e77197d56d198d375390def9aa18cdbf22e
  • MD5 1fd464bb9e06772654bf0f306392beec
  • SHA1 44cce7965f8a2288589ede09ea462a90e6cbce23
  • SHA512 33c0a74f5f6018d6dbc22d468feb337e28a206acb1ba7799d407c1cf28cb8e0196b939bf0c0f92c45ad24698bb190d01d66a78e4e89fcdd1dd5d7ddaaca28d84
  • SSDEEP 6144:zGZQ1thzjRY1VPr6ux7UkPf+52qDLgx9gfaY:qZYzjRYbP2ZkPG4OLgx9
  • TLSH
    T16DC65C341AB614F9F1E70C7D3A6DB7945FEDCBA8CA685B27C52404D6CC41B923ACA207
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2