Extracted

• • Target

    2025-04-24_e952190a98c53f52a1252fd9c91926bb_black-basta_elex_luca-stealer_smoke-loader

  • Size

    14.5MB

  • MD5

    e952190a98c53f52a1252fd9c91926bb

  • SHA1

    17ce5e5074bb0eb460e9d2e10a8290013be96e0f

  • SHA256

    e43e5ab74abfb739e8fd709e7153efc24afaae103f5dedf1aa2ec1e052d25d87

  • SHA512

    e249ce6efff9a6f2a7d9407058528a80784b737a546004ac0deb6df55ea8fa1f44601d74937df0eb81ec212e3a41a2a5b93ba52af7e07020ffc519b80781df93

  • SSDEEP

    3072:VZnbTHQC2mC+vdVcQuHAGSr9viHWhPxO796t6B7Aw5S2FxmEBVrVrVrVrVrVrVrM:vnJjcngGSrlqFp6kCyxT0

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2