Extracted

• • Target

    2025-03-30_e262ec8e9baff3b366098f7f157e2d34_black-basta_luca-stealer_smoke-loader

  • Size

    14.2MB

  • MD5

    e262ec8e9baff3b366098f7f157e2d34

  • SHA1

    4eafb2817a5f837e6cdbf86e9b09d27965f965a1

  • SHA256

    1003769505d0335f9b2a2a45944946d4cb0396cef7c5021328f7deb5ae4ec35c

  • SHA512

    1a9ed6bb9c16666a8063146c9bd750e60b49547df91cdcb40ce265818dc2c50c0f444b3e61e3c8dc6ec8604b1286bba726746793f544d0557796d851ca2ddaa6

  • SSDEEP

    49152:Cf5UwzWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWG:Cf

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2