General

  • Target

    System.exe

  • Size

    6.0MB

  • Sample

    230115-g8bpbsbb73

  • MD5

    e1d93c10865bb4228c0d4d780fb5ac88

  • SHA1

    233b4cb7cef41898eda51a869ff445c3db529ae4

  • SHA256

    4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

  • SHA512

    de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

  • SSDEEP

    49152:QY3oQWF4WcPg94+K2RjJjtE4HAZrGadSZMRPaThP46IPyIcju8HwQKpOlC6Z+XeP:Q+5Yri4Uaad5Ml0ojeUVbkJA+Axh

Malware Config

Extracted

Family

lucastealer

C2

https://api.telegram.org/bot5798214226:AAEtDAC9RFjL7TuqpdnFECmBJAay7aTl2tc

Targets

    • Target

      System.exe

    • Size

      6.0MB

    • MD5

      e1d93c10865bb4228c0d4d780fb5ac88

    • SHA1

      233b4cb7cef41898eda51a869ff445c3db529ae4

    • SHA256

      4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

    • SHA512

      de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

    • SSDEEP

      49152:QY3oQWF4WcPg94+K2RjJjtE4HAZrGadSZMRPaThP46IPyIcju8HwQKpOlC6Z+XeP:Q+5Yri4Uaad5Ml0ojeUVbkJA+Axh

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks