lucastealer | GIFT CARD GENERATOR[.]exe

Resubmissions

01-12-2022 16:35

221201-t36czagb68 10

14-09-2022 19:49

220914-yjp9vsbbg2 10

14-09-2022 16:10

220914-tmc2gseedn 10

Sharing

Copy URL

Twitter E-mail

General

Target

GIFT CARD GENERATOR.exe
Size

5.3MB
MD5

734639fae94d4e6d99b3492ecad433bb
SHA1

d1e1826f1d401da61ba7a6faed7edf9211a3f027
SHA256

1f35701b1e9a79f77c8aa5c030bbaa2628fa6f43c1eda7179df47f415c6c955a
SHA512

e98193b3b790b0a084d50647e604d12cc5caa8375e44cb308f2ad30f9e4052a37a02828b7d34821520ed5c2ce0f27688c044f69cdf7101931adb5e2b144fb37d
SSDEEP

49152:h7agP8SHo01rmxD53Em0l8EhrzLKHNAm3SISUoY5V495evhcCvZ+Xsvl8yo4j0QO:1XE4pZ98FDOkBt8BdOi+7a

Score

10^/10

lucastealer

Malware Config

Extracted

Family

lucastealer

https://discord.com/api/webhooks/1019485088087543848/iRsEwIDOUZy0VUI-bx7VeWjZ2nzophSnkLj5ezwzk-G2A5Mq0DYBu4JputxAps6-49tb

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_lucastealer
Lucastealer family
lucastealer

resource	yara_rule
sample	family_lucastealer

Files

GIFT CARD GENERATOR.exe
.exe windows x64

18bdf532715ca78d414d8e29c6f8713b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetSystemInfo
WakeConditionVariable
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetHandleInformation
GetModuleHandleA
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
SetFilePointerEx
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
CreateThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
FindClose
FindFirstFileW
CopyFileExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
ReadProcessMemory
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
OpenProcess
GetTickCount64
GetLogicalDrives
GlobalMemoryStatusEx
PostQueuedCompletionStatus
EnterCriticalSection
SleepConditionVariableSRW
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TerminateProcess
SwitchToThread
GetModuleHandleW
WakeAllConditionVariable
GlobalUnlock
GlobalLock
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GlobalFree
GlobalAlloc
MultiByteToWideChar
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TryAcquireSRWLockExclusive
WideCharToMultiByte
GlobalSize
Sleep
SetFileInformationByHandle
GetFileInformationByHandleEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
GetUserPreferredUILanguages
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
LeaveCriticalSection

advapi32

RegOpenKeyExW
SystemFunction036
OpenProcessToken
GetTokenInformation
LookupAccountSidW
GetUserNameW
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
WSASocketW
getsockopt
WSAIoctl
connect
ioctlsocket
send
recvfrom
WSAGetLastError
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
getpeername
WSAEnumNetworkEvents
WSAStartup
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSACreateEvent
WSACloseEvent
shutdown
WSASend
recv
getsockname
WSACleanup

crypt32

CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateChain
CertDuplicateCertificateContext
CryptUnprotectData

ntdll

RtlNtStatusToDosError
NtQuerySystemInformation
NtCreateFile
NtCancelIoFileEx
NtQueryInformationProcess
NtDeviceIoControlFile
RtlGetVersion

oleaut32

VariantClear
SysFreeString
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocString

pdh

PdhRemoveCounter
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCloseQuery

user32

EmptyClipboard
EnumDisplayMonitors
SetClipboardData
CloseClipboard
GetMonitorInfoW
OpenClipboard
EnumDisplaySettingsExW
GetClipboardData

gdi32

DeleteDC
GetDeviceCaps
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
CreateDCW
GetDIBits
GetObjectW

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
EnumProcessModulesEx

vcruntime140

memchr
strstr
strchr
memcmp
memmove
__CxxFrameHandler3
memset
memcpy
__current_exception
__current_exception_context
__C_specific_handler
strrchr

api-ms-win-crt-string-l1-1-0

strcmp
strncpy
strspn
strcspn
strpbrk
isupper
wcslen
strlen
strcpy
_strdup
tolower
strncmp

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
malloc
_msize
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_cexit
_c_exit
_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_set_app_type
_seh_filter_exe
_endthreadex
exit
__sys_nerr
_crt_atexit
abort
__sys_errlist
_errno
_initialize_onexit_table
_wassert
terminate
_beginthreadex

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
wcstombs
strtoll
strtol

api-ms-win-crt-stdio-l1-1-0

ftell
_read
_open
_write
fopen
fflush
__stdio_common_vsprintf
fputc
feof
__p__commode
_set_fmode
_close
__stdio_common_vsscanf
_lseeki64
fputs
fclose
fseek
fwrite
__acrt_iob_func
fread
fgets

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
_localtime64_s
strftime

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlink
_access
_stat64

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

18bdf532715ca78d414d8e29c6f8713b

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

ntdll

oleaut32

pdh

user32

gdi32

bcrypt

shell32

ole32

iphlpapi

netapi32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 109KB - Virtual size: 109KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 109KB - Virtual size: 109KB

.reloc
Size: 41KB - Virtual size: 41KB