Extracted

• • Target

    2025-04-04_1dec88a9b86093b618e7e077758fbcbb_black-basta_luca-stealer

  • Size

    14.9MB

  • MD5

    1dec88a9b86093b618e7e077758fbcbb

  • SHA1

    fdd4acbbb8665306ff9b04895793b4195c495c24

  • SHA256

    603f6cbb18c0253ad73d52cf235f38be4bda4f3286e0a13bd65dfb769fb74619

  • SHA512

    8f517bc6c07d0dfd7f6fc4d461bdb6adcd1760d09e88a07b43af0180fb63e3a340dbf606cfd18a2d56cecf113d3b3f49b83be554666101f68b928f3a2db4447c

  • SSDEEP

    3072:dl3t+DDATZKP7Ny5Da8nlGAYSjmhpsb9i1UjQJP+Xn2Dg7NVXewtwtwtwtwtwtwu:dzyeKP7qa8VmhpspedP+X2Dg7H

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1