Extracted

• • Target

    AutoCAD_Patch_Languague_2022_x64.exe

  • Size

    4.5MB

  • MD5

    c2b4425b66906d54cb7c9740bc6d4ba0

  • SHA1

    8e647dc068f7579b8fe5a24db25f1ecfeac4ace6

  • SHA256

    ff39886baad3900fbd5edceefd6058fe87435950ac6c46d5a222b90264b2f303

  • SHA512

    86e33e0224d021207a139263de5527788fce0f686cb581b1a54735378453c68d9ad525f271b995f28c91e881d329ab729920403d8c674410833ce0fd34f9f74f

  • SSDEEP

    98304:mtrbTA1TXSLLIBw+a5XLW6jRhdGVQguhhW31Z6:Yc1TiLLSwLL5LdGVzu+lc

  Score

  10^/10

  lucastealerevasionpersistencestealer

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

    stealerlucastealer

  • Luca Stealer payload

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2