Extracted

• • Target

    2025-04-04_fb908e35669f513de632ee64cc35b7af_black-basta_luca-stealer_smoke-loader

  • Size

    10.4MB

  • MD5

    fb908e35669f513de632ee64cc35b7af

  • SHA1

    add8720a302aaef17043a4ac3695da478195b4b9

  • SHA256

    db56666942629eda48c83e4f9158d5954533933c0a67d73675793ee23d92f3e2

  • SHA512

    d278a8b79ab5ddfc5209b31e8d7e9790034b3f682c914d23f1153cd7fc7cfdaaa34e5d1ec803fa557f1e12e395feefb861046d06bd4fb9cbe76c9ff2b82e227b

  • SSDEEP

    3072:JZnbTHQC2mC+vdVcQuHAGSr9viHWhPxO796t6B7Aw5S2FxmEBVrVrVrVrVrVrVrG:bnJjcngGSrlqFp6kCyxTO

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1