Extracted

• • Target

    2025-04-04_a1cbc7e727700a6143693eb7345c1cd2_black-basta_luca-stealer

  • Size

    14.0MB

  • MD5

    a1cbc7e727700a6143693eb7345c1cd2

  • SHA1

    cbd4eca89194b9ab0562dd6c98ccc7bcf5bad32f

  • SHA256

    86b61d5eee0fc02fcc5fbb06804981775d16f458cb0a8491f0074c9c3d2400e5

  • SHA512

    bdee95b844b02b5271d354899ef9e150783ec81bf65e07f5175bfdb7d5eff72c6c56d841c893b293e31832d8663eea14dc40656f6cbb7432f6862c2450f388fc

  • SSDEEP

    3072:I5nbTHQC2mC+vdVWQhHPGyCsPiHMhPxO7rFI7NP6BfGrIHmll9uX4YRrVOVOVOVY:MnJjWIvGyCYq/H2Ak5uXJ

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1