lucastealer | rust2[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rust2.exe
Size

4.2MB
MD5

21028a03e2284bfb84f54625fa2ce1a8
SHA1

d1db4d6b26e0494895a48dcc9710bef9dd47833b
SHA256

cb93b81cecd1f21ab966b7d6e8a888b4bf8f215911735fe25bd227fcb3f75577
SHA512

aecec4c6da063bc92daa5d61fc799dc75c221ba3f934537da4ca84db65db6aa18f8f782c0cd59bbfac03b0aa163d3df2b76ee822cc49b9211f6512f5dd2d3cdb
SSDEEP

49152:/Z1iGrIoQBLcS6rpe83bMMoEUWdeWoY6DINDcodCbZ2XLF+iHrCwZqdww9IEsbH5:hsMRtH3Jd14nAp

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource	yara_rule
sample	family_lucastealer

Lucastealer family
lucastealer

Files

rust2.exe
.exe windows x64

ffcfdb7f185750b37555c68f734d9882

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
DecryptMessage
AcceptSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
EncryptMessage

kernel32

SwitchToThread
SleepConditionVariableSRW
PostQueuedCompletionStatus
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
GetModuleHandleA
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
SetLastError
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
FindNextFileW
CreateDirectoryW
CreateThread
GetCurrentThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
FindClose
FindFirstFileW
CopyFileExW
WaitForSingleObject
SetHandleInformation
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
OpenProcess
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
HeapReAlloc
VirtualQueryEx
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
SetFilePointerEx
GetLogicalDrives
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandleEx
GetTickCount64
GetUserPreferredUILanguages
ReleaseSRWLockExclusive
GetLastError
AcquireSRWLockExclusive
WakeAllConditionVariable
CloseHandle
GetModuleHandleW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
LocalFree

advapi32

OpenProcessToken
LookupAccountSidW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
GetTokenInformation

ws2_32

connect
getsockname
send
closesocket
WSAGetLastError
recvfrom
WSAGetOverlappedResult
setsockopt
WSASend
WSAIoctl
bind
WSASocketW
getaddrinfo
ioctlsocket
getsockopt
shutdown
getpeername
recv
WSACloseEvent
WSACreateEvent
WSACleanup
WSARecv
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSAStartup
freeaddrinfo

crypt32

CertGetCertificateChain
CertGetNameStringA
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CertEnumCertificatesInStore
CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CryptUnprotectData
CryptDecodeObjectEx
CertOpenStore

oleaut32

SysAllocStringLen
VariantClear
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SysFreeString
SafeArrayGetUBound

pdh

PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA
PdhCloseQuery
PdhAddEnglishCounterW

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

user32

EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoW

gdi32

DeleteObject
SelectObject
SetStretchBltMode
DeleteDC
StretchBlt
GetDIBits
GetObjectW
CreateDCW
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoUninitialize

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ntdll

RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
EnumProcessModulesEx
GetPerformanceInfo

vcruntime140

memcpy
memset
memcmp
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
memmove
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strncpy
strcpy
strncmp
strpbrk
strcmp
wcslen
strlen
strcspn
strspn
tolower
_strdup
isupper

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
realloc
_msize
calloc
malloc

api-ms-win-crt-runtime-l1-1-0

_cexit
__p___argv
__p___argc
__sys_errlist
_c_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
__sys_nerr
_set_app_type
_seh_filter_exe
_endthreadex
_initialize_onexit_table
_register_onexit_function
_errno
_wassert
abort
_crt_atexit
terminate
_beginthreadex
_exit

api-ms-win-crt-convert-l1-1-0

strtoul
wcstombs
strtoll
atoi
strtol

api-ms-win-crt-stdio-l1-1-0

fflush
fopen
_open
_lseeki64
_set_fmode
__p__commode
_read
__acrt_iob_func
fread
fseek
fputc
fwrite
fclose
fputs
__stdio_common_vsscanf
_write
_close
fgets
feof
__stdio_common_vsprintf
ftell

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_stat64
_unlink

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffcfdb7f185750b37555c68f734d9882

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

ole32

bcrypt

shell32

ntdll

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 90KB - Virtual size: 90KB

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 90KB - Virtual size: 90KB

.reloc
Size: 28KB - Virtual size: 28KB