lucastealer | c231f2c16f42e16a0e8d760144b7fadf5c25c923dc9509beb166a21e1b6a27a8

Resubmissions

19-01-2023 16:49

230119-vbss8sde6z 10

23-11-2022 20:27

221123-y8x11acb87 1

Sharing

Copy URL

Twitter E-mail

General

Target

c231f2c16f42e16a0e8d760144b7fadf5c25c923dc9509beb166a21e1b6a27a8
Size

2.7MB
MD5

8646096d9fa97dd69b9f4747cab6d991
SHA1

19a62c02963be44471d9d7d3d22947937570df7f
SHA256

898cfb55ca329f0e50c424bc0ed3e22f3bfe2326f1df87626eb7839d7a060e95
SHA512

055c25626b8400cbe86cf3dca7c9931aec8b02f250ea6c6596c29b161c455cdc05cbc4504236b8c876a9e00bddae1af34a6ea16aae72ccca305311bc32cedc90
SSDEEP

49152:gsxc2TaAZGl/JMP2wmxCdR3HV4BjMbnolJFH2Fkh4M2rA5LnBCyiTTPQh6heQkIM:i2TUROKsdRXsjgnU8k6tAlsD/PQshvrM

Score

10^/10

lucastealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5740238611:AAESHdmffXlJNV7SD6-YjfXQmsg5jsSWb3Y

Signatures

Lucastealer family
lucastealer

Files

c231f2c16f42e16a0e8d760144b7fadf5c25c923dc9509beb166a21e1b6a27a8
.zip
c231f2c16f42e16a0e8d760144b7fadf5c25c923dc9509beb166a21e1b6a27a8
.exe windows x64

3dbcc1cddfc3ef5de6873a31936137ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

ApplyControlToken
DecryptMessage
QueryContextAttributesW
LsaGetLogonSessionData
AcquireCredentialsHandleA
AcceptSecurityContext
EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextW
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
FreeContextBuffer

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentThreadId
TryEnterCriticalSection
InitializeCriticalSection
AreFileApisANSI
HeapCreate
WriteFile
GetDiskFreeSpaceW
IsDebuggerPresent
HeapFree
CloseHandle
FindClose
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
GetSystemInfo
HeapReAlloc
WakeAllConditionVariable
RemoveDirectoryW
GetModuleFileNameW
SetFileInformationByHandle
GetUserPreferredUILanguages
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetFileInformationByHandleEx
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
SleepConditionVariableSRW
GetModuleHandleW
CreateFileW
SwitchToThread
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
AcquireSRWLockShared
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
SetFilePointerEx
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
CopyFileExW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
GetProcessTimes
OpenProcess
ReadProcessMemory
VirtualQueryEx
GetSystemTimes
GetProcessIoCounters
LocalFree
GlobalMemoryStatusEx
GetTickCount64
GetLogicalDrives
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA

ntdll

RtlGetVersion
NtCancelIoFileEx
NtQuerySystemInformation
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtQueryInformationProcess

oleaut32

SysAllocStringLen
SysFreeString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
SafeArrayDestroy
VariantClear

pdh

PdhRemoveCounter
PdhCloseQuery
PdhOpenQueryA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhAddEnglishCounterW

crypt32

CertFreeCertificateChainEngine
CertFreeCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy
CertCreateCertificateChainEngine
CertGetEnhancedKeyUsage
CryptQueryObject
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetNameStringA
CertFindExtension
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertGetCertificateChain
CertAddCertificateContextToStore
CertDuplicateStore
CryptUnprotectData
CertFindCertificateInStore
CertFreeCertificateContext
CertDuplicateCertificateChain
CertCloseStore

user32

EnumDisplayMonitors
EnumDisplaySettingsExW
GetMonitorInfoW

gdi32

DeleteDC
GetDeviceCaps
DeleteObject
GetObjectW
GetDIBits
StretchBlt
SetStretchBltMode
SelectObject
CreateCompatibleDC
CreateDCW
CreateCompatibleBitmap

advapi32

LookupAccountSidW
GetTokenInformation
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExA
RegSetValueExA
GetUserNameW
RegCloseKey
OpenProcessToken
SystemFunction036
CryptAcquireContextA
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

ws2_32

getpeername
getsockopt
WSACreateEvent
WSAStartup
freeaddrinfo
getaddrinfo
setsockopt
WSASocketW
bind
WSAEnumNetworkEvents
shutdown
connect
ioctlsocket
WSAIoctl
WSASend
WSAGetLastError
recvfrom
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
accept
htonl
listen
getsockname
WSAEventSelect
WSAWaitForMultipleEvents
WSARecv
send
WSAResetEvent
recv
select
closesocket
WSACleanup
WSACloseEvent

shell32

CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoSetProxyBlanket

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2

powrprof

CallNtPowerInformation

netapi32

NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

psapi

GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

memcmp
memset
__CxxFrameHandler3
__current_exception_context
memmove
__current_exception
__C_specific_handler
strchr
memchr
strstr
strrchr
memcpy

api-ms-win-crt-string-l1-1-0

strlen
wcslen
strcpy
strcspn
strspn
strncmp
strcmp
strpbrk
_strdup
strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_msize
free
calloc
malloc
realloc

api-ms-win-crt-runtime-l1-1-0

_initterm
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initialize_narrow_environment
_initterm_e
exit
_set_app_type
_seh_filter_exe
_endthreadex
_exit
__sys_nerr
__sys_errlist
__p___argc
_errno
_wassert
abort
terminate
_configure_narrow_argv
_beginthreadex
_crt_atexit
_initialize_onexit_table
__p___argv
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

wcstombs
strtol
strtoul
atoi
strtoll

api-ms-win-crt-stdio-l1-1-0

_open
fgets
fopen
fflush
__stdio_common_vsprintf
fputc
_read
_close
__p__commode
ftell
feof
_write
_set_fmode
__acrt_iob_func
__stdio_common_vsscanf
fputs
fclose
fread
fwrite
fseek
_lseeki64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_localtime64_s
_time64

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_stat64
_unlink

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

3dbcc1cddfc3ef5de6873a31936137ef

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

oleaut32

pdh

crypt32

user32

gdi32

advapi32

bcrypt

ws2_32

shell32

ole32

iphlpapi

powrprof

netapi32

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 29KB - Virtual size: 32KB

.pdata Size: 95KB - Virtual size: 95KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 29KB - Virtual size: 32KB

.pdata
Size: 95KB - Virtual size: 95KB

.reloc
Size: 31KB - Virtual size: 31KB