lucastealer | run[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

run.exe
Size

3.5MB
MD5

49f203a829465a2bdddbc02db0a08850
SHA1

13b3b2477333a195947e51395fa853c7f1807301
SHA256

b1b8848020af601787af019df15f22c08ec5e85eeb81fb99c2be1f55a2cc395f
SHA512

d4aebeb62fe52cee6f62fb997ae1af49e460298a8049ab8ae3c7a3b5b04db535391223baca5c75f179e6bed6de1127a0389b248139fa3686fdb7d9b56fa6d09e
SSDEEP

49152:ajKS8z7/wlD+D8aAk/B1sroSsQ1gZ+XvvOh+ytMDsRwXPRHfFFbBhbz6OCfT:0K1alownAZ

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource	yara_rule
sample	family_lucastealer

Lucastealer family
lucastealer

Files

run.exe
.exe windows x64

48fc78e655e66715e77c23e0b75778d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

send
recv
getpeername
shutdown
getsockopt
ioctlsocket
WSACleanup
WSAStartup
freeaddrinfo
WSACreateEvent
bind
select
closesocket
WSAGetOverlappedResult
setsockopt
WSASend
WSAIoctl
WSAGetLastError
WSASocketW
WSACloseEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
__WSAFDIsSet
WSAWaitForMultipleEvents
connect
getsockname
htons
ntohs
socket
WSASetLastError
getaddrinfo
listen
htonl
accept
WSARecv

crypt32

CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CryptUnprotectData

secur32

FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
QueryContextAttributesW
AcceptSecurityContext
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
ApplyControlToken
DecryptMessage
EncryptMessage
InitializeSecurityContextW

kernel32

UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
FlushViewOfFile
DeleteFileA
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
CreateMutexW
UnlockFileEx
SetEndOfFile
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
GetFullPathNameA
GetFileSize
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
ReadFile
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
GetEnvironmentVariableA
CloseHandle
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
WaitForSingleObject
GetUserPreferredUILanguages
GetTickCount64
GetLogicalDrives
SetFilePointerEx
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetFileInformationByHandleEx
SetFileInformationByHandle
DeleteFileW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetModuleHandleW
SwitchToThread
PostQueuedCompletionStatus
SleepConditionVariableSRW
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
GetModuleHandleA
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
FindNextFileW
CreateDirectoryW
CreateThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
FindClose
CopyFileExW
SetHandleInformation
OpenProcess
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
FindFirstFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA

pdh

PdhOpenQueryA
PdhGetFormattedCounterValue
PdhCloseQuery
PdhRemoveCounter
PdhAddEnglishCounterW
PdhCollectQueryData

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

user32

EnumDisplayMonitors
EnumDisplaySettingsExW
GetMonitorInfoW

gdi32

CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
CreateCompatibleBitmap
DeleteObject
GetDeviceCaps

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateInstance

advapi32

GetTokenInformation
LookupAccountSidW
OpenProcessToken
SystemFunction036
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
RegQueryValueExW
RegOpenKeyExW

ntdll

RtlGetVersion
NtQuerySystemInformation
NtQueryInformationProcess

powrprof

CallNtPowerInformation

oleaut32

VariantClear
SysFreeString
SysAllocString

psapi

GetModuleFileNameExW
GetPerformanceInfo
EnumProcessModulesEx

vcruntime140

memchr
memcpy
memset
memmove
__CxxFrameHandler3
strchr
strrchr
strstr
__C_specific_handler
__current_exception
__current_exception_context
memcmp

api-ms-win-crt-string-l1-1-0

strlen
strpbrk
strcspn
strcpy
isupper
strcmp
wcslen
_strdup
strncmp
strncpy
tolower
strspn

api-ms-win-crt-heap-l1-1-0

free
malloc
_msize
realloc
calloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_beginthreadex
_crt_atexit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_endthreadex
_initialize_onexit_table
_exit
_register_onexit_function
__sys_nerr
terminate
__sys_errlist
_errno

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
strtol
atoi
strtoul

api-ms-win-crt-stdio-l1-1-0

_set_fmode
_open
_read
_write
_close
__acrt_iob_func
fread
fwrite
fseek
fopen
fclose
fputs
__stdio_common_vsscanf
fflush
__stdio_common_vsprintf
fputc
feof
_lseeki64
ftell
__p__commode
fgets

api-ms-win-crt-time-l1-1-0

_time64
strftime
_localtime64_s
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_fstat64
_access

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 791KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48fc78e655e66715e77c23e0b75778d5

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

secur32

kernel32

pdh

iphlpapi

netapi32

user32

gdi32

bcrypt

shell32

ole32

advapi32

ntdll

powrprof

oleaut32

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 792KB - Virtual size: 791KB

.data Size: 25KB - Virtual size: 28KB

.pdata Size: 80KB - Virtual size: 79KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 792KB - Virtual size: 791KB

.data
Size: 25KB - Virtual size: 28KB

.pdata
Size: 80KB - Virtual size: 79KB

.reloc
Size: 24KB - Virtual size: 24KB