lucastealer | e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd

Analysis

max time kernel
97s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 14:18

Target

e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
Size

4.3MB
MD5

822d385ffc321a4e9042ecc11c7b46df
SHA1

5cb4f113ad2c4fab27d9ad101b5a3734d1764aeb
SHA256

e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd
SHA512

a9b69f211a2faa495ef8b13acd624194c44172663ef07ff01ad3d58505de312f9b06fa106a2e0c4e61bd821b529fda07894a7ee9efb952da0cdbd843fe0a1396
SSDEEP

49152:H1gF8jnXMJQbkaMB79ls430YCAV0BGiuvLoxbKKMpHpkx9dUIPcTm:V4Z9ZpBQY9IP9

Score

10^/10

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
520	e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
520	e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
520	e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
520	e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
520	e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
520	e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe

C:\Users\Admin\AppData\Local\Temp\e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
"C:\Users\Admin\AppData\Local\Temp\e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:520

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\sensfiles.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit