Extracted

• • Target

    2025-04-04_6c09c1793a9485ddf99bbbf46b9e443b_black-basta_luca-stealer

  • Size

    14.7MB

  • MD5

    6c09c1793a9485ddf99bbbf46b9e443b

  • SHA1

    af6e2515303e6ba3efd5aa6ac11bceb949840fea

  • SHA256

    84339e6b93e9977af2f0043f1c2bccad0a29da9233e0239907b7c5f42d0312df

  • SHA512

    d36579fc3c034331e9bac0d996f278880ad06463045ae9c6146154ed5ad238a4823275bf3cd529626603907dc20040af6e2a6d30364cbc8d93fcdae47467d76e

  • SSDEEP

    12288:BWaQslyPXVhHfUjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjje:YaQNlhHf7

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1