lucastealer | e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
Size

4.3MB
MD5

822d385ffc321a4e9042ecc11c7b46df
SHA1

5cb4f113ad2c4fab27d9ad101b5a3734d1764aeb
SHA256

e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd
SHA512

a9b69f211a2faa495ef8b13acd624194c44172663ef07ff01ad3d58505de312f9b06fa106a2e0c4e61bd821b529fda07894a7ee9efb952da0cdbd843fe0a1396
SSDEEP

49152:H1gF8jnXMJQbkaMB79ls430YCAV0BGiuvLoxbKKMpHpkx9dUIPcTm:V4Z9ZpBQY9IP9

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

resource	yara_rule
sample	family_lucastealer

Lucastealer family
lucastealer

Files

e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
.exe windows x64

9794d6f5590d8c517c92c6b26d876d6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

DecryptMessage
AcceptSecurityContext
EncryptMessage
ApplyControlToken
DeleteSecurityContext
FreeContextBuffer
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
FreeCredentialsHandle
LsaEnumerateLogonSessions

kernel32

PostQueuedCompletionStatus
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
GetModuleHandleA
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
GetFullPathNameW
SetFilePointerEx
FindNextFileW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileInformationByHandle
DuplicateHandle
CopyFileExW
SetHandleInformation
OpenProcess
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
SwitchToThread
DeviceIoControl
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
CreateDirectoryW
HeapReAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
DeleteFileW
GetFileInformationByHandleEx
GetLogicalDrives
GetTickCount64
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
GetUserPreferredUILanguages
ReleaseSRWLockExclusive
GetLastError
AcquireSRWLockExclusive
SleepConditionVariableSRW
WakeAllConditionVariable
CloseHandle
IsDebuggerPresent
GetDiskFreeSpaceExW

advapi32

SystemFunction036
GetTokenInformation
LookupAccountSidW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken

ws2_32

WSACloseEvent
recv
getpeername
shutdown
getsockopt
ioctlsocket
WSACleanup
WSAStartup
freeaddrinfo
WSAEnumNetworkEvents
WSASocketW
bind
WSAIoctl
WSAEventSelect
recvfrom
WSAGetLastError
closesocket
send
getsockname
connect
setsockopt
WSACreateEvent
WSAResetEvent
WSAWaitForMultipleEvents
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
listen
htonl
accept
getaddrinfo
select
WSARecv
WSAGetOverlappedResult
WSASend

crypt32

CertFindExtension
CryptQueryObject
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertOpenStore
CryptDecodeObjectEx
CryptUnprotectData
CertFindCertificateInStore
CertGetNameStringA

oleaut32

SafeArrayAccessData
SysAllocStringLen
VariantClear
SysAllocString
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString

pdh

PdhCloseQuery
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhOpenQueryA
PdhRemoveCounter

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups

user32

GetMonitorInfoW
EnumDisplaySettingsExW
EnumDisplayMonitors

gdi32

CreateCompatibleBitmap
SelectObject
SetStretchBltMode
CreateCompatibleDC
StretchBlt
GetDIBits
GetObjectW
DeleteObject
GetDeviceCaps
CreateDCW
DeleteDC

ole32

CoTaskMemFree
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ntdll

NtQueryInformationProcess
RtlGetVersion
NtQuerySystemInformation

powrprof

CallNtPowerInformation

psapi

EnumProcessModulesEx
GetPerformanceInfo
GetModuleFileNameExW

vcruntime140

__CxxFrameHandler3
memmove
memcmp
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
memset
memcpy

api-ms-win-crt-string-l1-1-0

strlen
strncmp
strpbrk
strcmp
strncpy
strcpy
tolower
strspn
strcspn
_strdup
wcslen
isupper

api-ms-win-crt-heap-l1-1-0

calloc
_msize
malloc
_set_new_mode
free
realloc

api-ms-win-crt-runtime-l1-1-0

_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_register_thread_local_exe_atexit_callback
_initterm
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_endthreadex
_crt_atexit
_initterm_e
terminate
__sys_errlist
_errno
abort
_wassert
_beginthreadex
_get_initial_narrow_environment
_register_onexit_function
__sys_nerr

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtol
wcstombs
strtoll

api-ms-win-crt-stdio-l1-1-0

_lseeki64
_close
fopen
fflush
__stdio_common_vsprintf
_set_fmode
__p__commode
__acrt_iob_func
fread
fseek
fputc
fwrite
fclose
fputs
__stdio_common_vsscanf
_open
_write
fgets
feof
_read
ftell

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
strftime
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_access
_fstat64

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9794d6f5590d8c517c92c6b26d876d6d

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

ole32

bcrypt

shell32

ntdll

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 90KB - Virtual size: 90KB

.reloc Size: 29KB - Virtual size: 29KB

.rsrc Size: 7KB - Virtual size: 7KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 90KB - Virtual size: 90KB

.reloc
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 7KB - Virtual size: 7KB