Extracted

• • Target

    2025-05-08_30f052af31bc2707545df5d0fe864640_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

  • Size

    14.8MB

  • MD5

    30f052af31bc2707545df5d0fe864640

  • SHA1

    f9d392a8ddacd0a008885e9a32175a18de342e84

  • SHA256

    d75045dc8f8c594c1ff7a72d5949db5c57d0c5854451f102d7f59bcd934be622

  • SHA512

    4c041f4ef392c4617845cdcfaa3c9f0d52647ca482d02d9b73791e87fea4ff553e09782118e5c4af3b3f17becd84d716d0944f70d21d4b0322fe103b42834f43

  • SSDEEP

    3072:AEvsKFt0pYpKaf6qDq+AltdnVlfbI4qfu9KBNqJXydUo8WR+gYXauauauauauauO:AEvse06KafvG+AlttV9I1GMYxydUotP

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2