lucastealer | rust[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rust.exe
Size

4.2MB
MD5

795a4fe7d2d6fa7adf455b832d53586a
SHA1

6ab69623b124747517b42124079b7e910c311c08
SHA256

30e923428a8f7f016603356c08387cd5b804633100cc3e91a7e40bbfef39ee26
SHA512

dade31801b2d52feba11ea8c60c2394809463c468b76dcc9f02d9e75383e94239fe653ef8502b23bfb8fc8e6223b3f0941b57f456824c6e22af8089d9bde1a81
SSDEEP

49152:D2p648E/EGyjlcm3+d7XFXFm5OiLgYrAvCT9GbUC+Z+XMvo6BCYqDM2wfNwOTZoI:qpJ0U1sDxkmdp4

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource	yara_rule
sample	family_lucastealer

Lucastealer family
lucastealer

Files

rust.exe
.exe windows x64

fe26b614093fe6392e139bfc0d75efa5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
DecryptMessage
AcceptSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
EncryptMessage

kernel32

GetModuleHandleW
SwitchToThread
SleepConditionVariableSRW
PostQueuedCompletionStatus
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
GetModuleHandleA
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
FindNextFileW
CreateDirectoryW
CreateThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
FindClose
FindFirstFileW
CopyFileExW
SetHandleInformation
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
ReadProcessMemory
HeapFree
OpenProcess
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetProcessHeap
HeapAlloc
SetLastError
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
SetFilePointerEx
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandleEx
GetLogicalDrives
GetTickCount64
GetUserPreferredUILanguages
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
CloseHandle
HeapReAlloc
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
VirtualQueryEx

advapi32

SystemFunction036
GetTokenInformation
LookupAccountSidW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken

ws2_32

connect
getsockname
send
closesocket
WSAGetLastError
recvfrom
WSAGetOverlappedResult
setsockopt
WSASend
WSAIoctl
WSASocketW
bind
getaddrinfo
ioctlsocket
getsockopt
shutdown
getpeername
recv
WSACloseEvent
WSACreateEvent
WSACleanup
WSARecv
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSAStartup
freeaddrinfo

crypt32

CertVerifyCertificateChainPolicy
CertFindExtension
CryptStringToBinaryA
PFXImportCertStore
CertGetCertificateChain
CertEnumCertificatesInStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertFindCertificateInStore
CryptUnprotectData
CryptDecodeObjectEx
CertOpenStore

oleaut32

SysAllocStringLen
VariantClear
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SysFreeString
SafeArrayGetUBound

pdh

PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA
PdhCloseQuery
PdhAddEnglishCounterW

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

user32

EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoW

gdi32

DeleteObject
SelectObject
SetStretchBltMode
DeleteDC
StretchBlt
GetDIBits
GetObjectW
CreateDCW
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoUninitialize

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ntdll

NtQueryInformationProcess
RtlGetVersion
NtQuerySystemInformation

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
EnumProcessModulesEx
GetPerformanceInfo

vcruntime140

memcpy
memset
__CxxFrameHandler3
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcmp

api-ms-win-crt-string-l1-1-0

strncpy
strcpy
strncmp
strpbrk
strcmp
wcslen
strlen
strcspn
strspn
tolower
_strdup
isupper

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
realloc
_msize
calloc
malloc

api-ms-win-crt-runtime-l1-1-0

_cexit
__p___argv
__p___argc
__sys_errlist
_c_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
__sys_nerr
_set_app_type
_seh_filter_exe
_endthreadex
_initialize_onexit_table
_register_onexit_function
_errno
_wassert
abort
_crt_atexit
terminate
_beginthreadex
_exit

api-ms-win-crt-convert-l1-1-0

strtoul
wcstombs
strtoll
atoi
strtol

api-ms-win-crt-stdio-l1-1-0

fflush
fopen
_open
_lseeki64
_set_fmode
__p__commode
_read
__acrt_iob_func
fread
fseek
fputc
fwrite
fclose
fputs
__stdio_common_vsscanf
_write
_close
fgets
feof
__stdio_common_vsprintf
ftell

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_stat64
_unlink

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe26b614093fe6392e139bfc0d75efa5

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

ole32

bcrypt

shell32

ntdll

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 91KB - Virtual size: 90KB

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 91KB - Virtual size: 90KB

.reloc
Size: 28KB - Virtual size: 28KB