Extracted

• • Target

    2025-04-04_caa0fde84567b9fd5c1ba8a338afad87_black-basta_luca-stealer

  • Size

    12.7MB

  • MD5

    caa0fde84567b9fd5c1ba8a338afad87

  • SHA1

    f9d0f545585e9662ce653d0caba713788af67113

  • SHA256

    d7d963662075ad46e9df0d4b8098a87a9199dfe65cfc7554c67de39849803fbe

  • SHA512

    ba173887bcf4d17d5e2e8854432d443fbb34c867f28c61fe482d2a39b773407c5eee986c999ec944615115bbb4a2892294cf745e853c5fea3f027c8a54d878c3

  • SSDEEP

    3072:wl3t+DDATZKP7Ny5Da8nlGAYSjmhpsb9i1UjQJP+Xn2Dg7NVXewtwtwtwtwtwtwn:wzyeKP7qa8VmhpspedP+X2Dg7H

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1