Extracted

• • Target

    2025-05-08_899548f164b6a4da8d483f4de3d60201_elex_gcleaner_rhadamanthys_smoke-loader

  • Size

    13.6MB

  • MD5

    899548f164b6a4da8d483f4de3d60201

  • SHA1

    700f3d23d5897aa1684e75c64f3aed8283e047f0

  • SHA256

    8186973c18e29731f991f5d9ca854da43c3d8ac5f922e56be959d506a75b2d70

  • SHA512

    80e91769a11cc7812cee5d91ff41ebf95a0f47e2e70b987e7fff711ee8e48b6341efc97dded396b90df856b055ff0d351e748cbb003587d3f3dcc823aca34573

  • SSDEEP

    49152:Ezzxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/:Ez

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1