lucastealer | SMS-GATEWAY[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

SMS-GATEWAY.exe
Size

4.8MB
MD5

cdc6b1fc0a7c8974f65d19b3749ec035
SHA1

b069e42c51637171d77ce2c86ed583d363596d65
SHA256

ddee07f531dfc4f279183d9f8de4cbed26da972f25ee44446419dc941deebf41
SHA512

8fdb7240bb9ad4c93990c44b51fb52991f489c6408df14e3a767ab176aef58c59cf080856744ca3c487cd3e357c3287e5d687983b51e55d041936c9204f5832c
SSDEEP

49152:xSrdbfYiaL0DYYEdhwWoGhI+4DHr+MohrAPV56S0vXfri+kJXTsI76mxRlYhbB5m:xydbfCgS2+u+MPVYvbBxO

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

resource	yara_rule
sample	family_lucastealer

Lucastealer family
lucastealer

Files

SMS-GATEWAY.exe
.exe windows x64

aa700ff6b6e5adc41cd63f96449a6ec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

CreateIoCompletionPort
SetFileCompletionNotificationModes
GetSystemInfo
WakeConditionVariable
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetHandleInformation
GetModuleHandleA
GetSystemTimeAsFileTime
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
SetFilePointerEx
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
SetFileInformationByHandle
CopyFileExW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
ReadProcessMemory
VirtualQueryEx
OpenProcess
GetTickCount64
GetLogicalDrives
GlobalMemoryStatusEx
PostQueuedCompletionStatus
TryAcquireSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TerminateProcess
SleepConditionVariableSRW
SwitchToThread
GetModuleHandleW
WakeAllConditionVariable
GlobalUnlock
GlobalLock
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeLibrary
GetProcAddress
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetQueuedCompletionStatusEx
LoadLibraryExW
GetComputerNameExW
GlobalFree
GlobalAlloc
MultiByteToWideChar
WideCharToMultiByte
GlobalSize
Sleep
GetFileInformationByHandleEx
GetUserPreferredUILanguages
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
EnterCriticalSection

advapi32

RegOpenKeyExW
SystemFunction036
OpenProcessToken
GetTokenInformation
LookupAccountSidW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
WSASocketW
getsockopt
WSAIoctl
connect
ioctlsocket
send
recvfrom
WSAGetLastError
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
getpeername
WSAEnumNetworkEvents
WSAStartup
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSACreateEvent
WSACloseEvent
shutdown
WSASend
recv
getsockname
WSACleanup

crypt32

CryptQueryObject
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateChain
CertFreeCertificateContext
CryptUnprotectData

ntdll

RtlGetVersion
NtDeviceIoControlFile
NtQueryInformationProcess
NtCreateFile
NtCancelIoFileEx
NtQuerySystemInformation
RtlNtStatusToDosError

oleaut32

VariantClear
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysAllocString
SysAllocStringLen

pdh

PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA
PdhCloseQuery

user32

EmptyClipboard
GetMonitorInfoW
OpenClipboard
SetClipboardData
CloseClipboard
GetClipboardData
EnumDisplayMonitors
EnumDisplaySettingsExW

gdi32

StretchBlt
GetDeviceCaps
GetObjectW
GetDIBits
CreateDCW
DeleteDC
SetStretchBltMode
CreateCompatibleDC
DeleteObject
CreateCompatibleBitmap
SelectObject

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
EnumProcessModulesEx

vcruntime140

memchr
strstr
strchr
memcmp
memmove
__CxxFrameHandler3
memset
memcpy
__current_exception
__current_exception_context
__C_specific_handler
strrchr

api-ms-win-crt-string-l1-1-0

strcmp
strncpy
strspn
strcspn
strpbrk
isupper
wcslen
strlen
strcpy
_strdup
tolower
strncmp

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
malloc
_msize
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_cexit
_c_exit
_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_set_app_type
_seh_filter_exe
_endthreadex
exit
__sys_nerr
_crt_atexit
abort
__sys_errlist
_errno
_initialize_onexit_table
_wassert
terminate
_beginthreadex

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
wcstombs
strtoll
strtol

api-ms-win-crt-stdio-l1-1-0

ftell
_read
_open
_write
fopen
fflush
__stdio_common_vsprintf
fputc
feof
__p__commode
_set_fmode
_close
__stdio_common_vsscanf
_lseeki64
fputs
fclose
fseek
fwrite
__acrt_iob_func
fread
fgets

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
_time64
strftime

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlink
_access
_stat64

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa700ff6b6e5adc41cd63f96449a6ec5

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

ntdll

oleaut32

pdh

user32

gdi32

bcrypt

shell32

ole32

iphlpapi

netapi32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 104KB - Virtual size: 103KB

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 104KB - Virtual size: 103KB

.reloc
Size: 39KB - Virtual size: 39KB