Extracted

• • Target

    2025-05-08_07c43afd7fb5302e1a86cfad4954e6df_elex_gcleaner_rhadamanthys_smoke-loader

  • Size

    14.8MB

  • MD5

    07c43afd7fb5302e1a86cfad4954e6df

  • SHA1

    155da35cddab2914a209eb6a8659fe4f7001274f

  • SHA256

    bf7ed9b70c4bb885e20bbcdbad7cc098a73ed82b77bf7e14964961a25813a2de

  • SHA512

    61cb81deec4e89d81cee8a47cf8eea4129ab11d67f50d16068fe3d8bee1193c17be539e421010430eb2d168fbea78b9851cf7a5f011b94f33432dd97214d1ee2

  • SSDEEP

    49152:rzzxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxV:rz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1