Analysis
-
max time kernel
127s -
max time network
244s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
30-11-2022 16:29
General
-
Target
rust-stealer-xss.exe
-
Size
5.0MB
-
MD5
c2fcf505705eb50782807229e0e940e3
-
SHA1
f45a2e53132f2e8a781a5a30708f9751d8af0225
-
SHA256
2ab60782ba60fb8d515529e687012ef99f54525ae00b30228f4667d65c79d08a
-
SHA512
19edd208112ddeca794d3e32a61948d66b844ee3c52918de5f38f80b0e515acc20306f8ee3f13ab26005a2c86ecf41097f2805c5a93b16e501463ade186a39b0
-
SSDEEP
49152:hw4L41k7Cp4lsf8JvIKO0NZ50R+1fFgeyBZVbXI3enjoEahogZGeJ53brCdZ+X+2:i4EVvDARaI3GoEahogAm4Fj6w+b
Score
10/10
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rust-stealer-xss.exe"C:\Users\Admin\AppData\Local\Temp\rust-stealer-xss.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken