lucastealer | 10121527889[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

10121527889.zip
Size

2.5MB
MD5

d169d69040b37cf773961f10fa15fa87
SHA1

b5d4f3f8883e75473af30b03c0300bfcce944773
SHA256

0eee88f8cdac6d231d970a44d72f5c2b47825a61edac7bc836ad3a2ee02327bd
SHA512

0fe7c9826730764966ff63cf046f0c0a7dd4031a6596015b00cf173f2d367baa4a93a01d65be6fe97079c9fa4e6827b9414e49fcfa1eddfe455be78cd8215a1c
SSDEEP

49152:RHcdXcuHSdCaG4kQXobGEBI62IoLlO8GvZX28W/+XcbpQJ1RnXarmJeIWr:RHcddydqZfB6HnZirRnXarQetr

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/272dba33ceab886a74b572a526b40945bd771fafb3a1b8b0717361f5c7ae066d	family_lucastealer

Lucastealer family
lucastealer

Files

10121527889.zip
.zip

Password: infected
272dba33ceab886a74b572a526b40945bd771fafb3a1b8b0717361f5c7ae066d
.exe windows x64

Password: infected

244136603f23a0f3698d1b8a24b01d6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

GlobalAlloc
GlobalFree
GetComputerNameExW
LoadLibraryExW
GetProcAddress
FreeLibrary
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapReAlloc
CreateDirectoryW
GlobalLock
GlobalUnlock
ReleaseSRWLockExclusive
GetModuleHandleW
SwitchToThread
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetSystemInfo
WakeConditionVariable
HeapAlloc
GetProcessHeap
HeapFree
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetHandleInformation
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileInformationByHandle
CopyFileExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
MultiByteToWideChar
ReadProcessMemory
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
OpenProcess
GetTickCount64
GetLogicalDrives
GlobalMemoryStatusEx
PostQueuedCompletionStatus
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
GetEnvironmentVariableA
SleepEx
MoveFileExA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
IsProcessorFeaturePresent
WideCharToMultiByte
GlobalSize
Sleep
GetFileInformationByHandleEx
GetUserPreferredUILanguages
WakeAllConditionVariable
GetLastError
AcquireSRWLockExclusive
CloseHandle
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
LocalFree
InitializeSListHead
UnhandledExceptionFilter

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW

oleaut32

VariantClear
SysAllocStringLen
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SafeArrayDestroy
SafeArrayGetUBound
SysAllocString

pdh

PdhCloseQuery
PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhRemoveCounter

crypt32

CertFreeCertificateChain
CertGetCertificateChain
PFXImportCertStore
CertFreeCertificateChainEngine
CertOpenStore
CertFindCertificateInStore
CertGetEnhancedKeyUsage
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CryptDecodeObjectEx
CertDuplicateCertificateContext
CryptStringToBinaryA
CertFreeCertificateContext
CertCreateCertificateChainEngine
CryptUnprotectData
CertCloseStore

user32

EnumDisplaySettingsExW
EnumDisplayMonitors
SetClipboardData
CloseClipboard
GetMonitorInfoW
OpenClipboard
EmptyClipboard
GetClipboardData

gdi32

GetDIBits
DeleteObject
StretchBlt
SetStretchBltMode
SelectObject
CreateCompatibleBitmap
DeleteDC
CreateDCW
GetObjectW
GetDeviceCaps
CreateCompatibleDC

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoInitializeEx
CoUninitialize

ws2_32

ntohs
WSASetLastError
__WSAFDIsSet
select
accept
htons
getsockname
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
WSAWaitForMultipleEvents
bind
WSASocketW
getsockopt
connect
send
recvfrom
closesocket
WSAIoctl
ioctlsocket
WSAGetLastError
getpeername
WSAResetEvent
WSAEventSelect
htonl
WSAEnumNetworkEvents
recv
WSASend
shutdown
listen
socket
WSACreateEvent
setsockopt
WSACloseEvent

ntdll

NtDeviceIoControlFile
NtQuerySystemInformation
NtCreateFile
NtCancelIoFileEx
RtlGetVersion
NtQueryInformationProcess
RtlNtStatusToDosError

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetPerformanceInfo
EnumProcessModulesEx

vcruntime140

memcpy
__current_exception_context
memset
__current_exception
__CxxFrameHandler3
memmove
memcmp
strchr
strrchr
strstr
memchr
__C_specific_handler

api-ms-win-crt-string-l1-1-0

strcspn
_strdup
strspn
strcmp
strlen
wcslen
strcpy
strncmp
strncpy
strpbrk

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_initialize_onexit_table
_wassert
_endthreadex
abort
__sys_errlist
__sys_nerr
_register_onexit_function
_seh_filter_exe
_set_app_type
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_configure_narrow_argv
_initialize_narrow_environment
_cexit
__p___argv
__p___argc
_get_initial_narrow_environment
_exit
exit
_initterm_e
_initterm
_beginthreadex

api-ms-win-crt-convert-l1-1-0

atoi
strtol
strtoll
strtoul
wcstombs

api-ms-win-crt-stdio-l1-1-0

__p__commode
_read
_write
_close
feof
fflush
fread
fputs
fseek
__stdio_common_vsscanf
fopen
__acrt_iob_func
fwrite
fclose
fgets
ftell
_lseeki64
fputc
_open
__stdio_common_vsprintf
_set_fmode

api-ms-win-crt-heap-l1-1-0

realloc
_msize
malloc
_set_new_mode
calloc
free

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
strftime
_time64

api-ms-win-crt-utility-l1-1-0

qsort
_rotl64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_fstat64
_unlink
_access

api-ms-win-crt-math-l1-1-0

_dclass
_fdopen
__setusermatherr
log

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

244136603f23a0f3698d1b8a24b01d6d

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

oleaut32

pdh

crypt32

user32

gdi32

bcrypt

shell32

ole32

ws2_32

ntdll

iphlpapi

netapi32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 27KB - Virtual size: 31KB

.pdata Size: 103KB - Virtual size: 103KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 27KB - Virtual size: 31KB

.pdata
Size: 103KB - Virtual size: 103KB

.reloc
Size: 41KB - Virtual size: 41KB