Analysis
-
max time kernel
130s -
max time network
235s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
30-11-2022 16:31
General
-
Target
rust-stealer-xss.exe
-
Size
5.0MB
-
MD5
94d2f40e712507a697171d22cc630ec3
-
SHA1
8a704ceecc8626f8ca2c0160c688db15458f1f42
-
SHA256
85893d402d55d9699da598022d22fa995e66d953998da7f74b0ffd4df4ef7d9f
-
SHA512
417e1b18a464ace7e9d4bb86677381110b065e03289b2cbf2375c5a585ce10a2fcdb5d4dd1baf4392fa045092aa7111d5bbe05451c7e4f0c82cec08c9a0d579a
-
SSDEEP
49152:Dw4L41k1OV4xB8JvIKO0NZ50R+1fFgeyBZVbXI3enjoEahogZGeJ53brCdZ+X+vo:M4EP+DARaI3GoEahogAm4Fj6w+Z
Score
10/10
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rust-stealer-xss.exe"C:\Users\Admin\AppData\Local\Temp\rust-stealer-xss.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken