Extracted

• • Target
    2026-11-13_b6876cc698282fca9fae5bcb30872fe8_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 14.9MB
  • SHA256 40e36e57110bad1b6afadc0e5354e694f1d54d2ed1cf4b65618486d18ff507aa
  • MD5 b6876cc698282fca9fae5bcb30872fe8
  • SHA1 6b92d61c392e2751ebc7decd97661f6ea6e74793
  • SHA512 744656b2efd375ad4bf44b7471fe46438c0cfaa6eb675a8d88594316a379cff91bf91ef294caeb59dcd7c950d0f8da375b667f57a5a5bacc38935667f200f5ad
  • SSDEEP 6144:i+DLnCQj29e/dCOhIctzibHYALvULoA144444444444444444444444444444440:i+D7fj2816cteYLoA
  • TLSH
    T1F4F62A785A962D56C3BF527CFE5CBB011DAC9FA2FA38A0156681EDC00013B951CA63DF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Windows security bypass

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2