Extracted

• • Target

    2025-04-04_8ab641ca62cc4ffb9f4af60643ab7bb9_black-basta_luca-stealer

  • Size

    12.5MB

  • MD5

    8ab641ca62cc4ffb9f4af60643ab7bb9

  • SHA1

    b7bc4c9eca112a673aec6fcf26ccffb19dc3c9ee

  • SHA256

    58dfe37377079346222270d2adad6cb3bb539f24762d16c763b653ba3d32d9be

  • SHA512

    ba7f19662d04babe59e5bbe91d7efc6328fc048b811172f9b9134176a83a4e6c0605833441acb9793361dfc74612f44bb18c1eb1836a037c3db846677d3d8dab

  • SSDEEP

    6144:Gx0+o7WWIsIrMhYUhxAeg4PgOHOrDnbvZFpkGgtTpiHqqqqqqqqqqqqqqqqqqqq8:Gx3o7WWb1Zgag8w7f8

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1