Extracted

• • Target

    2025-04-04_4ede1f95ebe3d550c06eb393171de1d8_black-basta_luca-stealer

  • Size

    10.8MB

  • MD5

    4ede1f95ebe3d550c06eb393171de1d8

  • SHA1

    fc4c1d0b27462e0e6d88dbe0f64c33753169586a

  • SHA256

    848b30717ca9b3c3b5348979705960b4d4f11c75dd2fe01cd40a6dafa5327402

  • SHA512

    9817bb96ff71f3a491af9616a51c445cd0e00bd1a2ebcc2acd060a01658da6151500a635ee68be063d9b3001d85302b814fd5d854ee56b6caa2b836ae990f6aa

  • SSDEEP

    3072:qd/4YU1GznYfU+kBGsrOp7XwL0wMjKRaD8ll3//0N0N0N0N0N0N0N0N0N0N0N0Nl:cAJGznKpe89gLlMOoD4

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1