Resubmissions

01-12-2022 16:35

221201-t345xagb67 10

23-11-2022 19:33

221123-x9kavshd23 10

General

  • Target

    SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe

  • Size

    17MB

  • Sample

    221201-t345xagb67

  • MD5

    8c2a390aa7833720b374a720a6d06e4d

  • SHA1

    188ec1a33bfd028333bcc3f6e96d2dbbdf01367f

  • SHA256

    eedeb7539b2f680304e81c08f27372bc5459b8e406872f8ea939065e466f0774

  • SHA512

    ac9bac95c37944ef7bb053126d5e5ba67c74562434b7bd4cb6f4c54e1d1cef8204990d670920f48af1cf26fb59ac422c0ccfe0075940cfe9c45e995897b86a07

  • SSDEEP

    98304:BMSVESq5M3ClAD3sXHLQTyaQRO+YwWcRImg0cHQwb4CsB/wpDm7qCOPXwRalZLCt:2SSSP7sNavN7mg0mlb3DDdDP0

Malware Config

Extracted

Family

lucastealer

C2

https://api.telegram.org/bot5740238611:AAESHdmffXlJNV7SD6-YjfXQmsg5jsSWb3Y

Targets

    • Target

      SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe

    • Size

      17MB

    • MD5

      8c2a390aa7833720b374a720a6d06e4d

    • SHA1

      188ec1a33bfd028333bcc3f6e96d2dbbdf01367f

    • SHA256

      eedeb7539b2f680304e81c08f27372bc5459b8e406872f8ea939065e466f0774

    • SHA512

      ac9bac95c37944ef7bb053126d5e5ba67c74562434b7bd4cb6f4c54e1d1cef8204990d670920f48af1cf26fb59ac422c0ccfe0075940cfe9c45e995897b86a07

    • SSDEEP

      98304:BMSVESq5M3ClAD3sXHLQTyaQRO+YwWcRImg0cHQwb4CsB/wpDm7qCOPXwRalZLCt:2SSSP7sNavN7mg0mlb3DDdDP0

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Tasks