lucastealer | smssender[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

smssender.exe
Size

5.3MB
MD5

47881409b1f98b45bd98f7ab8acecf1f
SHA1

fc57e25cfc44d5d7fca056482342ccad6145e295
SHA256

56b7410efd165c2e1a35eb9ad3c68b68aa89fdcd59dbd48933ab93218508f7ef
SHA512

5430c3b1387b792452eb936cad82c3e86fb613a3efef9c261644d2328f7a53956408f1f9183f604a5772e140ddb995abac4b627afb1b59ca2d3dda0046c6bbc1
SSDEEP

49152:skDJd0pXimoyaBCz8bJWfBpCAxIG2nttbIp9sTqbreVLTCqZ+XRvwm7Q8bZxVlKk:sIn+nFxmTImN4Bu0V0B+

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource	yara_rule
sample	family_lucastealer

Lucastealer family
lucastealer

Files

smssender.exe
.exe windows x64

df6a99c28895408e7084a3274a9c1ce8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

GetModuleHandleA
GetSystemTimeAsFileTime
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
SetFilePointerEx
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
SetFileInformationByHandle
CopyFileExW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
ReadProcessMemory
VirtualQueryEx
OpenProcess
GetTickCount64
GetLogicalDrives
GlobalMemoryStatusEx
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
DuplicateHandle
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetFileInformationByHandle
ReleaseSRWLockShared
WakeConditionVariable
GetSystemInfo
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetQueuedCompletionStatusEx
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
SwitchToThread
GetModuleHandleW
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetHandleInformation
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetFileInformationByHandleEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
GetUserPreferredUILanguages
WakeAllConditionVariable
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetTickCount

advapi32

RegOpenKeyExW
SystemFunction036
OpenProcessToken
GetTokenInformation
LookupAccountSidW
GetUserNameW
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
WSASocketW
getsockopt
WSAIoctl
connect
ioctlsocket
send
recvfrom
WSAGetLastError
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
getpeername
WSAEnumNetworkEvents
WSAStartup
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSACreateEvent
WSACloseEvent
shutdown
WSASend
recv
getsockname
WSACleanup

crypt32

CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateChain
CertFreeCertificateContext
CryptUnprotectData

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
NtQueryInformationProcess
NtQuerySystemInformation
RtlGetVersion
NtCancelIoFileEx

oleaut32

VariantClear
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SysAllocStringLen
SysAllocString
SysFreeString

pdh

PdhRemoveCounter
PdhCloseQuery
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhOpenQueryA

user32

EnumDisplayMonitors
EnumDisplaySettingsExW
GetMonitorInfoW

gdi32

CreateDCW
DeleteDC
GetDeviceCaps
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetObjectW
GetDIBits

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
CoInitializeEx

iphlpapi

GetIfTable2
GetIfEntry2
FreeMibTable

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
EnumProcessModulesEx

vcruntime140

memchr
strstr
strchr
memcmp
memmove
__CxxFrameHandler3
memset
memcpy
__current_exception
__current_exception_context
__C_specific_handler
strrchr

api-ms-win-crt-string-l1-1-0

strncmp
strncpy
isupper
_strdup
strspn
tolower
wcslen
strlen
strcpy
strpbrk
strcspn
strcmp

api-ms-win-crt-heap-l1-1-0

malloc
free
_msize
calloc
realloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_cexit
__p___argc
_crt_atexit
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_c_exit
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_endthreadex
_register_onexit_function
_errno
terminate
_wassert
abort
__sys_errlist
__sys_nerr
_initialize_narrow_environment
_initialize_onexit_table
__p___argv
_beginthreadex

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtoll
atoi
wcstombs

api-ms-win-crt-stdio-l1-1-0

fputc
_open
_lseeki64
fgets
_close
ftell
feof
_set_fmode
__p__commode
fflush
fopen
_read
_write
__acrt_iob_func
fread
fwrite
fseek
__stdio_common_vsscanf
fclose
fputs
__stdio_common_vsprintf

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
strftime
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_access
_stat64
_unlink

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df6a99c28895408e7084a3274a9c1ce8

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

ntdll

oleaut32

pdh

user32

gdi32

bcrypt

shell32

ole32

iphlpapi

netapi32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 109KB - Virtual size: 109KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 109KB - Virtual size: 109KB

.reloc
Size: 41KB - Virtual size: 41KB