Extracted

• • Target

    2025-04-04_f7a90a445087c5cfba1dbe93b42616f4_black-basta_luca-stealer

  • Size

    10.4MB

  • MD5

    f7a90a445087c5cfba1dbe93b42616f4

  • SHA1

    ed68469f3728716f4b6a595da21745b9c00cba6b

  • SHA256

    58d263a465b3cbceadee5179e6001af1ba2ce05d7b7e92ec698d2740d233ac4d

  • SHA512

    602de8960581b5983672b4a1bc4e4c601d17bb3f90787b310290cc9238eab4a44524c5b6ffd5320b66323c9213baa3ed51c16415d3bd2076005b45d7706ce6fc

  • SSDEEP

    3072:Jd/4YU1GznYfU+kBGsrOp7XwL0wMjKRaD8ll3//0N0N0N0N0N0N0N0N0N0N0N0NF:DAJGznKpe89gLlMOoD4

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1