lucastealer | rswin[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rswin.exe
Size

5.6MB
MD5

59ff6641dea3e3d3e2e6abd3e1ccb357
SHA1

533f88a140383aaaf735b62d550b02bb2705db42
SHA256

303bc7a7372b58fcf86cec6e3f64c68ae8d0d4005ba456f1a3d083ad554fe6ef
SHA512

58b10df383b6ecf8dfcd8e5e23b82b88e61af34ae2b2eb6607423858ad43ef5c8f82c7c882ca63b10fd60f62b85dc18a213857598bbf7bf82c71528a4eb8591b
SSDEEP

49152:ucLMXimdb4cv+oUX63PWbo1OI83xGXgn5KnK8ICuasCDZ+X6vR7e73UK56xmDpfY:PEiKisj8EjIhW8Yp4oTjZ+

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_lucastealer
Lucastealer family
lucastealer

resource	yara_rule
sample	family_lucastealer

Files

rswin.exe
.exe windows x64

16f1e742eabafffe31b6eb9ff97d2e0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

FreeLibrary
GetFileInformationByHandleEx
Sleep
GlobalSize
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
GlobalFree
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CreateDirectoryW
GlobalLock
GlobalUnlock
WakeAllConditionVariable
GetModuleHandleW
SwitchToThread
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetSystemInfo
WakeConditionVariable
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
SetFilePointerEx
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
FindFirstFileW
FindClose
SetHandleInformation
CreateThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
SetFileInformationByHandle
CopyFileExW
GetProcessTimes
GetSystemTimes
GetProcAddress
LocalFree
ReadProcessMemory
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
OpenProcess
GlobalMemoryStatusEx
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TerminateProcess
LoadLibraryExW
GetComputerNameExW
GetLogicalDrives
GetTickCount64
GetUserPreferredUILanguages
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessIoCounters
InitializeSListHead
IsProcessorFeaturePresent

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW

oleaut32

SysAllocStringLen
SafeArrayUnaccessData
SysAllocString
SafeArrayGetUBound
SysFreeString
SafeArrayAccessData
SafeArrayGetLBound
VariantClear

crypt32

CertGetNameStringA
CertFreeCertificateChain
CertAddCertificateContextToStore
CertOpenStore
CertEnumCertificatesInStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CryptQueryObject
CertCreateCertificateChainEngine
CertFindExtension
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertFreeCertificateChainEngine
CryptUnprotectData
CertGetCertificateChain
CertCloseStore
CertFreeCertificateContext

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserEnum

user32

EmptyClipboard
GetMonitorInfoW
GetClipboardData
OpenClipboard
CloseClipboard
SetClipboardData
EnumDisplayMonitors
EnumDisplaySettingsExW

gdi32

SetStretchBltMode
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteObject
GetDeviceCaps
StretchBlt
GetDIBits
GetObjectW
DeleteDC

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
CoInitializeSecurity

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
recv
send
getsockname
WSASend
WSARecv
getpeername
getsockopt
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
setsockopt
select
bind
ioctlsocket
WSAIoctl
WSAWaitForMultipleEvents
htons
connect
closesocket
WSAGetLastError
recvfrom
ntohs
socket
WSASetLastError
__WSAFDIsSet
accept
htonl
listen
WSASocketW
shutdown

ntdll

NtCancelIoFileEx
RtlGetVersion
NtDeviceIoControlFile
NtCreateFile
NtQueryInformationProcess
NtQuerySystemInformation
RtlNtStatusToDosError

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhOpenQueryA
PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetPerformanceInfo
EnumProcessModulesEx

vcruntime140

memmove
strrchr
__current_exception
__current_exception_context
strchr
memcmp
__CxxFrameHandler3
memset
memcpy
strstr
__C_specific_handler
memchr

api-ms-win-crt-string-l1-1-0

strcpy
wcslen
strlen
_strdup
strncpy
strcmp
strcspn
strpbrk
strncmp
strspn

api-ms-win-crt-heap-l1-1-0

calloc
_msize
realloc
malloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_register_onexit_function
_initialize_onexit_table
_c_exit
_wassert
abort
_errno
_register_thread_local_exe_atexit_callback
__sys_errlist
_cexit
__p___argv
__p___argc
__sys_nerr
_beginthreadex
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
terminate
_set_app_type
_seh_filter_exe
_endthreadex

api-ms-win-crt-convert-l1-1-0

atoi
strtol
strtoul
wcstombs
strtoll

api-ms-win-crt-stdio-l1-1-0

_read
_write
_close
fputs
_set_fmode
__stdio_common_vsscanf
feof
ftell
_lseeki64
__acrt_iob_func
fread
fgets
fwrite
fseek
_open
__stdio_common_vsprintf
fopen
fflush
fclose
__p__commode
fputc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
strftime
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_unlink
_fstat64

api-ms-win-crt-math-l1-1-0

_dclass
log
_fdopen
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16f1e742eabafffe31b6eb9ff97d2e0c

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

oleaut32

crypt32

iphlpapi

netapi32

user32

gdi32

shell32

ole32

bcrypt

ws2_32

ntdll

pdh

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 113KB - Virtual size: 113KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 113KB - Virtual size: 113KB

.reloc
Size: 44KB - Virtual size: 43KB