Extracted

• • Target

    2025-04-04_a8433ed2dce68af46d91394a9f3cda7e_black-basta_luca-stealer

  • Size

    12.3MB

  • MD5

    a8433ed2dce68af46d91394a9f3cda7e

  • SHA1

    7cf1a08230c80f3490b35442b02a19bdbc5ba411

  • SHA256

    750e0e46119245d6c6086debf721e333ecf27061bc22a57b3979bf345f57462c

  • SHA512

    184cb61f981338c70aaee3b50370ce65d050f0a260a30f5af74ee5d108a4afa1ef9467a164f7e9e0b57ca3ccd03ca50ced12ef5c0015cca76bff2ceb9cb2c162

  • SSDEEP

    49152:HiSUBoooooooooooooooooooooooooooooooooooooooooooooooooooooooooon:HbU

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1