Extracted

• • Target

    2025-04-04_a2c2c95048ed493b62574befb9575745_black-basta_luca-stealer

  • Size

    13.7MB

  • MD5

    a2c2c95048ed493b62574befb9575745

  • SHA1

    bc4a3f52beffa6254822abd9c56525c796278699

  • SHA256

    962dc595bf11c09fbeca7a6918d68fda1924910c5d7d55f0ce981179dacfe06d

  • SHA512

    3cb890e6471bc14e61e22ba5c1f8145ae6ef24935793001de8c3ba4d4803d90ccb663a48c0cac4e6a55f52e9205e9806b3d1a90e5904726f84443a15b80df141

  • SSDEEP

    3072:Xl3t+DDATZKP7Ny5Da8nlGAYSjmhpsb9i1UjQJP+Xn2Dg7NVXewtwtwtwtwtwtws:XzyeKP7qa8VmhpspedP+X2Dg7Hu

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1