Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    7.9MB

  • Sample

    221103-r8plasbef6

  • MD5

    656132a78eeaabea8d8a81569d95282e

  • SHA1

    6b684983a1d2de4dcbb56b1a6a8c887505954781

  • SHA256

    174957651aa39490a2fa567bb4ca581f97597a7c289de76ebdf55701ffc891f8

  • SHA512

    883634ac73e3f246cbe201312fe0869df838282d11203c38eddafbcde87175da94218fbeff1c031c566c7f6287785ed90b964e3a06a5889d3277965ee734e3ef

  • SSDEEP

    196608:SCwCI0E5DGKXXzDIV0TYk45gmA8Ut6DFw306uSH1a:HuLDDIIYk45gMUkDFQ0hSVa

Score
10/10
lucastealerbootkitevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      7.9MB

    • MD5

      656132a78eeaabea8d8a81569d95282e

    • SHA1

      6b684983a1d2de4dcbb56b1a6a8c887505954781

    • SHA256

      174957651aa39490a2fa567bb4ca581f97597a7c289de76ebdf55701ffc891f8

    • SHA512

      883634ac73e3f246cbe201312fe0869df838282d11203c38eddafbcde87175da94218fbeff1c031c566c7f6287785ed90b964e3a06a5889d3277965ee734e3ef

    • SSDEEP

      196608:SCwCI0E5DGKXXzDIV0TYk45gmA8Ut6DFw306uSH1a:HuLDDIIYk45gMUkDFQ0hSVa

    Score
    10/10
    lucastealerbootkitevasionpersistencestealertrojan

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

      stealerlucastealer

    • Luca Stealer payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks